72c360444f50f7b6d53d54f1a57e3544c65b2cc3b7fae5db839f7931f69e3838

Analysis

max time kernel
38s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 09:07

Target

72c360444f50f7b6d53d54f1a57e3544c65b2cc3b7fae5db839f7931f69e3838.dll
Size

150KB
MD5

aca55b39a10b64d471f7a742ecee0a70
SHA1

e82511d3fde5b9b81b545b0bbadf533ce1c8b72a
SHA256

72c360444f50f7b6d53d54f1a57e3544c65b2cc3b7fae5db839f7931f69e3838
SHA512

df7ccee3439629a328607df757568b1886aeb734b1402c3af23e5f8e8ce8477bfc8f6a3c6085b9292b48ad3cfc629e1e1789de406ef6172da5a2b7740e6fc24f
SSDEEP

3072:suhE6zRkA1syAdo7J8D56D/eKgSTdhQOSljmCp8wt/:suh/1ReD56KKgSJhQL9d/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
736	1308	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 1308	956	rundll32.exe	28
PID 956 wrote to memory of 1308	956	rundll32.exe	28
PID 956 wrote to memory of 1308	956	rundll32.exe	28
PID 956 wrote to memory of 1308	956	rundll32.exe	28
PID 956 wrote to memory of 1308	956	rundll32.exe	28
PID 956 wrote to memory of 1308	956	rundll32.exe	28
PID 956 wrote to memory of 1308	956	rundll32.exe	28
PID 1308 wrote to memory of 736	1308	rundll32.exe	29
PID 1308 wrote to memory of 736	1308	rundll32.exe	29
PID 1308 wrote to memory of 736	1308	rundll32.exe	29
PID 1308 wrote to memory of 736	1308	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\72c360444f50f7b6d53d54f1a57e3544c65b2cc3b7fae5db839f7931f69e3838.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\72c360444f50f7b6d53d54f1a57e3544c65b2cc3b7fae5db839f7931f69e3838.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 272
    3⤵
    - Program crash
    PID:736

memory/1308-55-0x0000000075B61000-0x0000000075B63000-memory.dmp

Filesize
8KB

Download