9d1f5dfa237a1b67da0a1cf9e4e3c4aa04b40a08ad57c1c6849eafb76f0432ee

Analysis

max time kernel
23s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 06:17

Target

9d1f5dfa237a1b67da0a1cf9e4e3c4aa04b40a08ad57c1c6849eafb76f0432ee.dll
Size

35KB
MD5

378e676fd674bb656653d5a920130299
SHA1

643e985930d9972d8deea7349bf5b450b3676638
SHA256

9d1f5dfa237a1b67da0a1cf9e4e3c4aa04b40a08ad57c1c6849eafb76f0432ee
SHA512

459c3848ff5adbbd6a3851435f90266f29c71b09072cff0e393866b0f2f2bc4f554ab689fa0e27ccb103fd5f9b72d054e50b8208b151fbd5cdc4e27d1350b19c
SSDEEP

384:lGL/VoTd0vqxwLnt2nmlIOuyLLegnoIo9tHTmeDoQOkjCdojdfsYtfSL:CVoTdFeLt2ouiegoIo9tzToQqdoBfu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
980	1932	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 1932	1644	rundll32.exe	28
PID 1644 wrote to memory of 1932	1644	rundll32.exe	28
PID 1644 wrote to memory of 1932	1644	rundll32.exe	28
PID 1644 wrote to memory of 1932	1644	rundll32.exe	28
PID 1644 wrote to memory of 1932	1644	rundll32.exe	28
PID 1644 wrote to memory of 1932	1644	rundll32.exe	28
PID 1644 wrote to memory of 1932	1644	rundll32.exe	28
PID 1932 wrote to memory of 980	1932	rundll32.exe	29
PID 1932 wrote to memory of 980	1932	rundll32.exe	29
PID 1932 wrote to memory of 980	1932	rundll32.exe	29
PID 1932 wrote to memory of 980	1932	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9d1f5dfa237a1b67da0a1cf9e4e3c4aa04b40a08ad57c1c6849eafb76f0432ee.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9d1f5dfa237a1b67da0a1cf9e4e3c4aa04b40a08ad57c1c6849eafb76f0432ee.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 228
    3⤵
    - Program crash
    PID:980

memory/1932-55-0x0000000075FB1000-0x0000000075FB3000-memory.dmp

Filesize
8KB

Download