af966453f1ce9960104bdd2664a2db90ea831d06ca099ac89d9921b2bcd0c6a2

Analysis

max time kernel
29s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 09:22

Target

af966453f1ce9960104bdd2664a2db90ea831d06ca099ac89d9921b2bcd0c6a2.dll
Size

251KB
MD5

708dbc116b93904d87526bf6d08138ad
SHA1

f65ecb86950c2e308d60e736e8a904d673068d28
SHA256

af966453f1ce9960104bdd2664a2db90ea831d06ca099ac89d9921b2bcd0c6a2
SHA512

655b9382d0c29e612122a759ef2df2aaf6951cc967bc49314d3f6a3734d914198c2ebc7e9b4fa0072242eb6f78d4798537a8ab3176874315dd7a16b9400b6970
SSDEEP

6144:TXt8VaLuxvxL4IaOT6tEm93WfwM31tOK+e:TaVaLavxsIa3nGP31n9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
808	872	WerFault.exe	26

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 872 wrote to memory of 808	872	rundll32.exe	27
PID 872 wrote to memory of 808	872	rundll32.exe	27
PID 872 wrote to memory of 808	872	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\af966453f1ce9960104bdd2664a2db90ea831d06ca099ac89d9921b2bcd0c6a2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:872
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 872 -s 128
  2⤵
  - Program crash
  PID:808