b54825ba69c46709ad675558cb44e2af6d81e493037167909eb0e49c0b3e2a67

Analysis

max time kernel
16s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 14:49

Target

b54825ba69c46709ad675558cb44e2af6d81e493037167909eb0e49c0b3e2a67.dll
Size

358KB
MD5

052d379eeab0d76435d291aa974635af
SHA1

7832dbf4a86a1565c26a8c7bbc59e5ee4aa2ceb3
SHA256

b54825ba69c46709ad675558cb44e2af6d81e493037167909eb0e49c0b3e2a67
SHA512

19ae788c3704edda649660454114ee1fe078c944ee2ef441eb11debcbaaaecea9384abbf964610b8ed723dc7531f164c0621571e1b1fddde1325b440faa3bb18
SSDEEP

6144:UYo7Y+Ou/fvZ2R61kppOW3/PmoATjhGkQYqd/a0lrUNcbr4deniOn:87NZ/fvZIp3P+ZZiYGlrecb8dei

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1280	2004	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2004	2000	rundll32.exe	27
PID 2000 wrote to memory of 2004	2000	rundll32.exe	27
PID 2000 wrote to memory of 2004	2000	rundll32.exe	27
PID 2000 wrote to memory of 2004	2000	rundll32.exe	27
PID 2000 wrote to memory of 2004	2000	rundll32.exe	27
PID 2000 wrote to memory of 2004	2000	rundll32.exe	27
PID 2000 wrote to memory of 2004	2000	rundll32.exe	27
PID 2004 wrote to memory of 1280	2004	rundll32.exe	28
PID 2004 wrote to memory of 1280	2004	rundll32.exe	28
PID 2004 wrote to memory of 1280	2004	rundll32.exe	28
PID 2004 wrote to memory of 1280	2004	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b54825ba69c46709ad675558cb44e2af6d81e493037167909eb0e49c0b3e2a67.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b54825ba69c46709ad675558cb44e2af6d81e493037167909eb0e49c0b3e2a67.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 228
    3⤵
    - Program crash
    PID:1280

memory/2004-55-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/2004-56-0x0000000000250000-0x00000000002AD000-memory.dmp

Filesize
372KB

Download
memory/2004-60-0x0000000010000000-0x000000001005D000-memory.dmp

Filesize
372KB

Download
memory/2004-62-0x0000000000120000-0x000000000017F000-memory.dmp

Filesize
380KB

Download