ba936b666f22cbffaa6e813bb456514710a937554412701d86e1d877e0edfc7b

Analysis

max time kernel
20s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 17:57

Target

ba936b666f22cbffaa6e813bb456514710a937554412701d86e1d877e0edfc7b.dll
Size

35KB
MD5

1160760cae180ae993e0fef27d61e24e
SHA1

8dae0ef760d44f14d94fff84038a021ce1820868
SHA256

ba936b666f22cbffaa6e813bb456514710a937554412701d86e1d877e0edfc7b
SHA512

0783d343ba78fa6b709e0ee81305aa9cad45a748877281b0590c378c242a6793267e7054165aa5352d3b669823cfd99adfcad279ff1e8f95d9113cd804c3b13e
SSDEEP

768:QRO+QLt0iBCM0bG2PZg+FdI0FhT5mNu0ieky:Q0+qw+yZg+bXFsu0k

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2020	2012	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 2012	1260	rundll32.exe	28
PID 1260 wrote to memory of 2012	1260	rundll32.exe	28
PID 1260 wrote to memory of 2012	1260	rundll32.exe	28
PID 1260 wrote to memory of 2012	1260	rundll32.exe	28
PID 1260 wrote to memory of 2012	1260	rundll32.exe	28
PID 1260 wrote to memory of 2012	1260	rundll32.exe	28
PID 1260 wrote to memory of 2012	1260	rundll32.exe	28
PID 2012 wrote to memory of 2020	2012	rundll32.exe	29
PID 2012 wrote to memory of 2020	2012	rundll32.exe	29
PID 2012 wrote to memory of 2020	2012	rundll32.exe	29
PID 2012 wrote to memory of 2020	2012	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba936b666f22cbffaa6e813bb456514710a937554412701d86e1d877e0edfc7b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba936b666f22cbffaa6e813bb456514710a937554412701d86e1d877e0edfc7b.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 280
    3⤵
    - Program crash
    PID:2020

memory/2012-55-0x0000000075C41000-0x0000000075C43000-memory.dmp

Filesize
8KB

Download
memory/2012-56-0x00000000001B0000-0x0000000000207000-memory.dmp

Filesize
348KB

Download
memory/2012-57-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download
memory/2012-58-0x00000000002E0000-0x000000000038C000-memory.dmp

Filesize
688KB

Download
memory/2012-60-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download