d297fe63797249c87f5fbeedfba1f42a6b828aa912f49cf50a730b4a77be0014

Analysis

max time kernel
22s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 17:36

Target

d297fe63797249c87f5fbeedfba1f42a6b828aa912f49cf50a730b4a77be0014.dll
Size

781KB
MD5

078383e8e90abfedd1efb167787b7313
SHA1

8d1e0e5373260d2147cdf5d18cdda8055c385313
SHA256

d297fe63797249c87f5fbeedfba1f42a6b828aa912f49cf50a730b4a77be0014
SHA512

8179826e3168bbe04f3b772b1c1ea649dc3b994e4966fe410a10c30e9b469bf41eb29213434e02e54fe2efdb095949459eb4956102add6b97010e82199d2c7d3
SSDEEP

24576:bUHCXJByrdNpZwUg1EdLZvFwp2s61FABdV6:Y8WPFcEdLZNps6V

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1728	1172	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 1172	1224	rundll32.exe	28
PID 1224 wrote to memory of 1172	1224	rundll32.exe	28
PID 1224 wrote to memory of 1172	1224	rundll32.exe	28
PID 1224 wrote to memory of 1172	1224	rundll32.exe	28
PID 1224 wrote to memory of 1172	1224	rundll32.exe	28
PID 1224 wrote to memory of 1172	1224	rundll32.exe	28
PID 1224 wrote to memory of 1172	1224	rundll32.exe	28
PID 1172 wrote to memory of 1728	1172	rundll32.exe	29
PID 1172 wrote to memory of 1728	1172	rundll32.exe	29
PID 1172 wrote to memory of 1728	1172	rundll32.exe	29
PID 1172 wrote to memory of 1728	1172	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d297fe63797249c87f5fbeedfba1f42a6b828aa912f49cf50a730b4a77be0014.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d297fe63797249c87f5fbeedfba1f42a6b828aa912f49cf50a730b4a77be0014.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1172 -s 268
    3⤵
    - Program crash
    PID:1728

memory/1172-54-0x0000000000000000-mapping.dmp

Download
memory/1172-55-0x0000000076711000-0x0000000076713000-memory.dmp

Filesize
8KB

Download
memory/1728-56-0x0000000000000000-mapping.dmp

Download