ccf4098301f5426c38e4f6428e8ed3b776ee085a0f78ebe7b4e158a519090105

Analysis

max time kernel
40s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 05:35

Target

ccf4098301f5426c38e4f6428e8ed3b776ee085a0f78ebe7b4e158a519090105.dll
Size

76KB
MD5

720f4b2ef1aff0889c750498a193cdcd
SHA1

4223fd3ce0a179af85a5e21cd9d28c14286a6e78
SHA256

ccf4098301f5426c38e4f6428e8ed3b776ee085a0f78ebe7b4e158a519090105
SHA512

7719bfd3e00010f9b0aeba5166d324332b58b57318b74806aca98e12c993122d1629696787a841ac7926f9a3a7322e78e6311db850535e4cf52828ea22b1e266
SSDEEP

1536:kEDuOu9FnH+DQQmm98F6M8/QC+s5IOeHnToIf1OxczY68bOD6:k+QeDPL/Q7sTeHTBfEuzY68bOD

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
860	1120	WerFault.exe	26

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 1120	1248	rundll32.exe	26
PID 1248 wrote to memory of 1120	1248	rundll32.exe	26
PID 1248 wrote to memory of 1120	1248	rundll32.exe	26
PID 1248 wrote to memory of 1120	1248	rundll32.exe	26
PID 1248 wrote to memory of 1120	1248	rundll32.exe	26
PID 1248 wrote to memory of 1120	1248	rundll32.exe	26
PID 1248 wrote to memory of 1120	1248	rundll32.exe	26
PID 1120 wrote to memory of 860	1120	rundll32.exe	27
PID 1120 wrote to memory of 860	1120	rundll32.exe	27
PID 1120 wrote to memory of 860	1120	rundll32.exe	27
PID 1120 wrote to memory of 860	1120	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ccf4098301f5426c38e4f6428e8ed3b776ee085a0f78ebe7b4e158a519090105.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ccf4098301f5426c38e4f6428e8ed3b776ee085a0f78ebe7b4e158a519090105.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1120
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 264
    3⤵
    - Program crash
    PID:860

memory/1120-55-0x0000000075351000-0x0000000075353000-memory.dmp

Filesize
8KB

Download