c4c7c387f32e8377dc2a0caa233e0efb9894c0deda91af73e5a96a0c5f930fd6

Analysis

max time kernel
3s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 00:44

Target

c4c7c387f32e8377dc2a0caa233e0efb9894c0deda91af73e5a96a0c5f930fd6.dll
Size

18KB
MD5

f7d96ac1fd22f3ca9c1e8e3a57b38385
SHA1

9aa1f31ac9df4858c9d6767d01795a0357a0751e
SHA256

c4c7c387f32e8377dc2a0caa233e0efb9894c0deda91af73e5a96a0c5f930fd6
SHA512

c758413e132570c1b97e8d38e4684e65168cadd98383a7f99cefc31d14503b02f164c0e8f2d052133caca175b34cd72755a8cae1eea04108c768325cd9840b64
SSDEEP

384:SwAFumagyxDtZFnDuhGGP5nlDBWO3N7DdSILVBk0Ln8CjC7:Sw7magyTDuTJRw87DFLnYCG7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
928	932	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 932	1476	rundll32.exe	28
PID 1476 wrote to memory of 932	1476	rundll32.exe	28
PID 1476 wrote to memory of 932	1476	rundll32.exe	28
PID 1476 wrote to memory of 932	1476	rundll32.exe	28
PID 1476 wrote to memory of 932	1476	rundll32.exe	28
PID 1476 wrote to memory of 932	1476	rundll32.exe	28
PID 1476 wrote to memory of 932	1476	rundll32.exe	28
PID 932 wrote to memory of 928	932	rundll32.exe	29
PID 932 wrote to memory of 928	932	rundll32.exe	29
PID 932 wrote to memory of 928	932	rundll32.exe	29
PID 932 wrote to memory of 928	932	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c4c7c387f32e8377dc2a0caa233e0efb9894c0deda91af73e5a96a0c5f930fd6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c4c7c387f32e8377dc2a0caa233e0efb9894c0deda91af73e5a96a0c5f930fd6.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 204
    3⤵
    - Program crash
    PID:928

memory/932-55-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download