bc44f40ef12c3698870c37693b93f879b91ce180dd266efcf835983233e222f3

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 07:28

Target

bc44f40ef12c3698870c37693b93f879b91ce180dd266efcf835983233e222f3.dll
Size

113KB
MD5

374c8aefa3b54fa755b30fa2c3013a90
SHA1

f6438d3781bfa8bb36bbeca91ce3681e30ff2fa2
SHA256

bc44f40ef12c3698870c37693b93f879b91ce180dd266efcf835983233e222f3
SHA512

76e0d960515d21ceb91c76175d119bd7cb3df696536b1c4fb4ee89c77f85948fe0ebce7e18cf41db9760b22830c7569060235666b8c11f31434714fb380b576c
SSDEEP

3072:xHMPqlBbtpyq7M45bjxiLvk89IS8L+IW6:xHMQBbtpbTuLc89IS8R

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1396	940	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 940	1980	rundll32.exe	28
PID 1980 wrote to memory of 940	1980	rundll32.exe	28
PID 1980 wrote to memory of 940	1980	rundll32.exe	28
PID 1980 wrote to memory of 940	1980	rundll32.exe	28
PID 1980 wrote to memory of 940	1980	rundll32.exe	28
PID 1980 wrote to memory of 940	1980	rundll32.exe	28
PID 1980 wrote to memory of 940	1980	rundll32.exe	28
PID 940 wrote to memory of 1396	940	rundll32.exe	29
PID 940 wrote to memory of 1396	940	rundll32.exe	29
PID 940 wrote to memory of 1396	940	rundll32.exe	29
PID 940 wrote to memory of 1396	940	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc44f40ef12c3698870c37693b93f879b91ce180dd266efcf835983233e222f3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc44f40ef12c3698870c37693b93f879b91ce180dd266efcf835983233e222f3.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 940 -s 248
    3⤵
    - Program crash
    PID:1396

memory/940-55-0x00000000756B1000-0x00000000756B3000-memory.dmp

Filesize
8KB

Download
memory/940-56-0x00000000001B0000-0x00000000001BF000-memory.dmp

Filesize
60KB

Download
memory/940-57-0x00000000001E0000-0x0000000000200000-memory.dmp

Filesize
128KB

Download