0805235094e0648f7c0e1c493f1316a5a64744c06351fb26458c808d308ba791

Analysis

max time kernel
6s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 11:40

Target

0805235094e0648f7c0e1c493f1316a5a64744c06351fb26458c808d308ba791.dll
Size

5KB
MD5

ef8aab5186de1de8426a2180139b74d0
SHA1

66647392e2e0356484ed648f16f40efbc1ecc445
SHA256

0805235094e0648f7c0e1c493f1316a5a64744c06351fb26458c808d308ba791
SHA512

0e9853771e9cf2fe53bca20376708a33b8160d709057ea494ec28220cc3cc052f6c710f7b70f6cb33c34ce3d20de9f06417d244669cea89c4d0be8467b939b96
SSDEEP

48:SASAl6a98rtNVhWOZU8tOZGK3hOvxEM2mWy6Z5qj7QEGOZCl:f8rv2OZVtOZdxIxFO35qQEOl

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
776	1432	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 1432	1552	rundll32.exe	28
PID 1552 wrote to memory of 1432	1552	rundll32.exe	28
PID 1552 wrote to memory of 1432	1552	rundll32.exe	28
PID 1552 wrote to memory of 1432	1552	rundll32.exe	28
PID 1552 wrote to memory of 1432	1552	rundll32.exe	28
PID 1552 wrote to memory of 1432	1552	rundll32.exe	28
PID 1552 wrote to memory of 1432	1552	rundll32.exe	28
PID 1432 wrote to memory of 776	1432	rundll32.exe	29
PID 1432 wrote to memory of 776	1432	rundll32.exe	29
PID 1432 wrote to memory of 776	1432	rundll32.exe	29
PID 1432 wrote to memory of 776	1432	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0805235094e0648f7c0e1c493f1316a5a64744c06351fb26458c808d308ba791.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0805235094e0648f7c0e1c493f1316a5a64744c06351fb26458c808d308ba791.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 232
    3⤵
    - Program crash
    PID:776

memory/1432-55-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download