7c801f2f59f677fc9bfbf5a4aec2bf38522d66af05dff61f557b213f5965efb0

Analysis

max time kernel
36s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 06:49

Target

7c801f2f59f677fc9bfbf5a4aec2bf38522d66af05dff61f557b213f5965efb0.dll
Size

272KB
MD5

00fce4ecfdfd55b018d75c814ccfc540
SHA1

1f7d3c81c3ed1b38f86e858f6586372c6ae6f125
SHA256

7c801f2f59f677fc9bfbf5a4aec2bf38522d66af05dff61f557b213f5965efb0
SHA512

e5a1192e0294bf9466e207a8fc237fde1a9d667c61002f25e4de4410f7072b93a3d67b96942ba3ee8c7059d55cd0ebd8075c20b65e3f7e1a91f9a50dfabdb300
SSDEEP

6144:BGCjmWfKVFMkG2XCGjh2pqs+xpqxZL4uEP+1oWM1:MrWfKFTXC+hoq0ZL4uP1oWM

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1144	1460	WerFault.exe	26

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26
PID 1460 wrote to memory of 1144	1460	rundll32.exe	27
PID 1460 wrote to memory of 1144	1460	rundll32.exe	27
PID 1460 wrote to memory of 1144	1460	rundll32.exe	27
PID 1460 wrote to memory of 1144	1460	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7c801f2f59f677fc9bfbf5a4aec2bf38522d66af05dff61f557b213f5965efb0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7c801f2f59f677fc9bfbf5a4aec2bf38522d66af05dff61f557b213f5965efb0.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1460
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 240
    3⤵
    - Program crash
    PID:1144

memory/1460-55-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download
memory/1460-56-0x0000000000230000-0x0000000000277000-memory.dmp

Filesize
284KB

Download
memory/1460-60-0x0000000000200000-0x0000000000230000-memory.dmp

Filesize
192KB

Download