de94b7d1637b8e1e105a60c944d3b346de8fa64f298df5751d4356ae25992d29

Analysis

max time kernel
31s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 13:15

Target

de94b7d1637b8e1e105a60c944d3b346de8fa64f298df5751d4356ae25992d29.dll
Size

228KB
MD5

53ad87299f93c43c2f6736537be63b10
SHA1

13703fbc0f88955aca047730d0ffc456907792af
SHA256

de94b7d1637b8e1e105a60c944d3b346de8fa64f298df5751d4356ae25992d29
SHA512

ec235242b2ec3c143e5d71a44f129d42676d4c644119589efbb287b847b029146564fc4a2c6f050d544c34e61a94f2ad0ed3046df277fe7c290b1be81b31e62a
SSDEEP

3072:DOKEDOvvxxOz7kIC1uJhL1kNMpniRInH2QpfhihKNe++a5KsAvx1htMNV8D/Kww7:DOKiOxQoI954OniyJpfhNABawLb+3Qi

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
912	1956	WerFault.exe	26

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 1956	1620	rundll32.exe	26
PID 1620 wrote to memory of 1956	1620	rundll32.exe	26
PID 1620 wrote to memory of 1956	1620	rundll32.exe	26
PID 1620 wrote to memory of 1956	1620	rundll32.exe	26
PID 1620 wrote to memory of 1956	1620	rundll32.exe	26
PID 1620 wrote to memory of 1956	1620	rundll32.exe	26
PID 1620 wrote to memory of 1956	1620	rundll32.exe	26
PID 1956 wrote to memory of 912	1956	rundll32.exe	27
PID 1956 wrote to memory of 912	1956	rundll32.exe	27
PID 1956 wrote to memory of 912	1956	rundll32.exe	27
PID 1956 wrote to memory of 912	1956	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\de94b7d1637b8e1e105a60c944d3b346de8fa64f298df5751d4356ae25992d29.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\de94b7d1637b8e1e105a60c944d3b346de8fa64f298df5751d4356ae25992d29.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 228
    3⤵
    - Program crash
    PID:912

memory/1956-55-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/1956-56-0x0000000000290000-0x00000000002E9000-memory.dmp

Filesize
356KB

Download
memory/1956-60-0x00000000001A0000-0x00000000001D8000-memory.dmp

Filesize
224KB

Download
memory/1956-62-0x00000000001A0000-0x00000000001D8000-memory.dmp

Filesize
224KB

Download