a891e831c8f7d05e5403cfa3d5cce5937b512dead9146bfdfdbb2d72d2bbdefb

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 12:11

Target

a891e831c8f7d05e5403cfa3d5cce5937b512dead9146bfdfdbb2d72d2bbdefb.dll
Size

144KB
MD5

37f12f5203e1008e254c33ed5c697da5
SHA1

4482eef11be48eba1ecd169b04beaa3697f167dc
SHA256

a891e831c8f7d05e5403cfa3d5cce5937b512dead9146bfdfdbb2d72d2bbdefb
SHA512

b0fd9b11f5414e5dddbe195494e40cee96ab47241624a35700f8254da994a43015862c44817453dbc1a44e4122b57497e94def365f6941a1a77160e0b2377d91
SSDEEP

3072:ndUP4vpdFCd6w+JaO1bP7O+Qc3q3FmqacLSSeKRAJEolPzTQZ51LEN1E8QorKgo:nmtWXG1mqacLSSx0zTQZ4jEPQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1896	1080	WerFault.exe	26

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 1080 wrote to memory of 1896	1080	rundll32.exe	27
PID 1080 wrote to memory of 1896	1080	rundll32.exe	27
PID 1080 wrote to memory of 1896	1080	rundll32.exe	27
PID 1080 wrote to memory of 1896	1080	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a891e831c8f7d05e5403cfa3d5cce5937b512dead9146bfdfdbb2d72d2bbdefb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a891e831c8f7d05e5403cfa3d5cce5937b512dead9146bfdfdbb2d72d2bbdefb.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 240
    3⤵
    - Program crash
    PID:1896

memory/1080-55-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download
memory/1080-57-0x0000000010000000-0x0000000010026000-memory.dmp

Filesize
152KB

Download
memory/1080-58-0x00000000001F0000-0x00000000001FF000-memory.dmp

Filesize
60KB

Download
memory/1080-59-0x0000000000200000-0x000000000020F000-memory.dmp

Filesize
60KB

Download