bae1be07637501a423204c8940f840d3d184038dd4ae4ba6dc0bc7970841f8cb

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 05:30

Target

bae1be07637501a423204c8940f840d3d184038dd4ae4ba6dc0bc7970841f8cb.dll
Size

120KB
MD5

65b77d5d20576cb6f361130b2871fe00
SHA1

49a48864f7db3ae2de07206fda6612754a7b7241
SHA256

bae1be07637501a423204c8940f840d3d184038dd4ae4ba6dc0bc7970841f8cb
SHA512

1e6cc4e1d96a04f83f58eabb5b761ac35bee358d2bd3daf5858b6674c4266f95cdf41b197c9f2b18b357b0776f140b1d80b25cddbcd24e0c3113920674b4fe06
SSDEEP

3072:e3XPsMtJA+CNpWIscX4Ul6yv2Ii8LCZzDp0+pQR:e3XPCN4tr0Ti8s/3Y

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2004	1892	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1892	1640	rundll32.exe	28
PID 1640 wrote to memory of 1892	1640	rundll32.exe	28
PID 1640 wrote to memory of 1892	1640	rundll32.exe	28
PID 1640 wrote to memory of 1892	1640	rundll32.exe	28
PID 1640 wrote to memory of 1892	1640	rundll32.exe	28
PID 1640 wrote to memory of 1892	1640	rundll32.exe	28
PID 1640 wrote to memory of 1892	1640	rundll32.exe	28
PID 1892 wrote to memory of 2004	1892	rundll32.exe	29
PID 1892 wrote to memory of 2004	1892	rundll32.exe	29
PID 1892 wrote to memory of 2004	1892	rundll32.exe	29
PID 1892 wrote to memory of 2004	1892	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1be07637501a423204c8940f840d3d184038dd4ae4ba6dc0bc7970841f8cb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1be07637501a423204c8940f840d3d184038dd4ae4ba6dc0bc7970841f8cb.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 196
    3⤵
    - Program crash
    PID:2004

memory/1892-55-0x0000000075921000-0x0000000075923000-memory.dmp

Filesize
8KB

Download
memory/1892-57-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download