2971a8051f52cafdec8054d22f856e64405f7cbac4814dbef3de2ac6fe3a2b1b

Analysis

max time kernel
25s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 23:13

Target

2971a8051f52cafdec8054d22f856e64405f7cbac4814dbef3de2ac6fe3a2b1b.dll
Size

296KB
MD5

8a1b289fc90c19ada32d4ece8af45404
SHA1

199721b44a02524aa13b7c65bd3c2506372d4cf7
SHA256

2971a8051f52cafdec8054d22f856e64405f7cbac4814dbef3de2ac6fe3a2b1b
SHA512

89fde210134e70edd74e39466e0bd171a3d8e67b4032d2b4dde6b7fc2bf53b3f61647725fe3179fdd2cc86a618cdd3374976bcfdabd4d1ba72214f05a5ee8e62
SSDEEP

6144:b/FmdtUm7H9WNG9VxviI4GT+z0YphDDvI3EtpOXg42ZwPGb91:5Atis9iIxTby6j2aOb91

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
904	1964	WerFault.exe	9

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 904	1964	rundll32.exe	28
PID 1964 wrote to memory of 904	1964	rundll32.exe	28
PID 1964 wrote to memory of 904	1964	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2971a8051f52cafdec8054d22f856e64405f7cbac4814dbef3de2ac6fe3a2b1b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1964 -s 92
  2⤵
  - Program crash
  PID:904