aa9167c36550cdf185b4ea281ec937bc0722768fc1bb5d30804abfd57022044f

Analysis

max time kernel
3s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 15:41

Target

aa9167c36550cdf185b4ea281ec937bc0722768fc1bb5d30804abfd57022044f.dll
Size

156KB
MD5

5cc5d91d29ad2a3dcd861e11e36fd4a6
SHA1

29b1be3f3ea59cefac5aa640906bbf555e00714c
SHA256

aa9167c36550cdf185b4ea281ec937bc0722768fc1bb5d30804abfd57022044f
SHA512

46456ea77f85417db982ead8cd5f9b3f019cbbf5d64fc2c4dcfbb7a3f2b83cd13c67cf96b85ecce356d54b5d995a4844d7a5ee425da1de911681b8034871c7a2
SSDEEP

3072:VJvjS8J43gSEL16a8/rsy1mP7pJN9wEPobatJd2JUpn1h:7vuwB8/rjmP7V1Fpn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1340	1972	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 1972	1788	rundll32.exe	28
PID 1788 wrote to memory of 1972	1788	rundll32.exe	28
PID 1788 wrote to memory of 1972	1788	rundll32.exe	28
PID 1788 wrote to memory of 1972	1788	rundll32.exe	28
PID 1788 wrote to memory of 1972	1788	rundll32.exe	28
PID 1788 wrote to memory of 1972	1788	rundll32.exe	28
PID 1788 wrote to memory of 1972	1788	rundll32.exe	28
PID 1972 wrote to memory of 1340	1972	rundll32.exe	29
PID 1972 wrote to memory of 1340	1972	rundll32.exe	29
PID 1972 wrote to memory of 1340	1972	rundll32.exe	29
PID 1972 wrote to memory of 1340	1972	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa9167c36550cdf185b4ea281ec937bc0722768fc1bb5d30804abfd57022044f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa9167c36550cdf185b4ea281ec937bc0722768fc1bb5d30804abfd57022044f.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 240
    3⤵
    - Program crash
    PID:1340

memory/1972-55-0x00000000760D1000-0x00000000760D3000-memory.dmp

Filesize
8KB

Download
memory/1972-56-0x0000000000160000-0x0000000000173000-memory.dmp

Filesize
76KB

Download
memory/1972-57-0x00000000001E0000-0x000000000020A000-memory.dmp

Filesize
168KB

Download
memory/1972-61-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download
memory/1972-63-0x0000000000160000-0x0000000000173000-memory.dmp

Filesize
76KB

Download