8676900f9dc2629151384937a9cfb4b7fea0a9a99c8673643b4ca9c6f31d568a

Analysis

max time kernel
30s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 09:52

Target

8676900f9dc2629151384937a9cfb4b7fea0a9a99c8673643b4ca9c6f31d568a.dll
Size

1.7MB
MD5

9bf70e48a22b2b8f4a7d463cbd2fe83c
SHA1

633bb8b74396afc503d0e11d92fc21931f433f2f
SHA256

8676900f9dc2629151384937a9cfb4b7fea0a9a99c8673643b4ca9c6f31d568a
SHA512

0cd4220ba776258d52141985501f8cbc6a5e63d22a3f71dd15aa3fa51c0c8850458100020e06071402963176948b490fe40ce0ec8cd9432975c30435ea295028
SSDEEP

1536:lFDUIYkK4cEui1gNNx0eW6QPB/4ZW1ck8zHhTduu+qjIk9WkD2oHxzt4nou:7hYZ4z1sxtbjIUWnoRziou

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1348	1392	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 1392	624	rundll32.exe	28
PID 624 wrote to memory of 1392	624	rundll32.exe	28
PID 624 wrote to memory of 1392	624	rundll32.exe	28
PID 624 wrote to memory of 1392	624	rundll32.exe	28
PID 624 wrote to memory of 1392	624	rundll32.exe	28
PID 624 wrote to memory of 1392	624	rundll32.exe	28
PID 624 wrote to memory of 1392	624	rundll32.exe	28
PID 1392 wrote to memory of 1348	1392	rundll32.exe	29
PID 1392 wrote to memory of 1348	1392	rundll32.exe	29
PID 1392 wrote to memory of 1348	1392	rundll32.exe	29
PID 1392 wrote to memory of 1348	1392	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8676900f9dc2629151384937a9cfb4b7fea0a9a99c8673643b4ca9c6f31d568a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8676900f9dc2629151384937a9cfb4b7fea0a9a99c8673643b4ca9c6f31d568a.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1392
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 196
    3⤵
    - Program crash
    PID:1348

memory/1392-55-0x00000000766F1000-0x00000000766F3000-memory.dmp

Filesize
8KB

Download