d770cad39ed5ea72b296b3453263cdc380755f76f42930f18e730ef7a40b81e9

Analysis

max time kernel
19s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 11:15

Target

d770cad39ed5ea72b296b3453263cdc380755f76f42930f18e730ef7a40b81e9.dll
Size

94KB
MD5

2fdb39a041ba44e46794157777fb48b0
SHA1

1a6f92e145d65651040a1deea464e09338bc4610
SHA256

d770cad39ed5ea72b296b3453263cdc380755f76f42930f18e730ef7a40b81e9
SHA512

e29bc7c9eea103389ce3bf7754643a275660506e8a64d2ac3a9c91d327cbc8cbccea65d707e80cedb0ca38da59590868acac9e46307fc0675350a7f104e87b02
SSDEEP

1536:9pxmEnN/VxO8GYDzrye48hwA3ypZzBIToUlGtcx7cyRSXf8tUgRaN04fzF991yUT:9H/xOYDzphwYK8Yu7/RSP8tUE4p9ryUT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1364	2004	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 2004	1692	rundll32.exe	28
PID 1692 wrote to memory of 2004	1692	rundll32.exe	28
PID 1692 wrote to memory of 2004	1692	rundll32.exe	28
PID 1692 wrote to memory of 2004	1692	rundll32.exe	28
PID 1692 wrote to memory of 2004	1692	rundll32.exe	28
PID 1692 wrote to memory of 2004	1692	rundll32.exe	28
PID 1692 wrote to memory of 2004	1692	rundll32.exe	28
PID 2004 wrote to memory of 1364	2004	rundll32.exe	29
PID 2004 wrote to memory of 1364	2004	rundll32.exe	29
PID 2004 wrote to memory of 1364	2004	rundll32.exe	29
PID 2004 wrote to memory of 1364	2004	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d770cad39ed5ea72b296b3453263cdc380755f76f42930f18e730ef7a40b81e9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d770cad39ed5ea72b296b3453263cdc380755f76f42930f18e730ef7a40b81e9.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 260
    3⤵
    - Program crash
    PID:1364

memory/2004-55-0x0000000076651000-0x0000000076653000-memory.dmp

Filesize
8KB

Download