72b347b9990d06d8a72c66deed69a6ec14159cd6cb46ec23b202757e885b4e4a

Analysis

max time kernel
3s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 23:49

Target

72b347b9990d06d8a72c66deed69a6ec14159cd6cb46ec23b202757e885b4e4a.dll
Size

212KB
MD5

6b30060f5c4f829c2134e411828f3981
SHA1

0e25174116fe7ddcc5c9a2785fb6429620cab389
SHA256

72b347b9990d06d8a72c66deed69a6ec14159cd6cb46ec23b202757e885b4e4a
SHA512

6fda8848eb6a5c252ebd19a2a296ecc90ec22bd34523389a55afeab344a09f49d286b34bc67dc5e5ebb2386173f6f762cbc2d9928307865a0e233a080747dff9
SSDEEP

3072:Kfof6T/oelUit28FfmQwgSpxX2vcVKbhj8OiZVEZfroH0B9p8uptCir:Kfof6zo0FfZwrLXj8bhmZmZG0B91

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
480	520	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 520	816	rundll32.exe	28
PID 816 wrote to memory of 520	816	rundll32.exe	28
PID 816 wrote to memory of 520	816	rundll32.exe	28
PID 816 wrote to memory of 520	816	rundll32.exe	28
PID 816 wrote to memory of 520	816	rundll32.exe	28
PID 816 wrote to memory of 520	816	rundll32.exe	28
PID 816 wrote to memory of 520	816	rundll32.exe	28
PID 520 wrote to memory of 480	520	rundll32.exe	29
PID 520 wrote to memory of 480	520	rundll32.exe	29
PID 520 wrote to memory of 480	520	rundll32.exe	29
PID 520 wrote to memory of 480	520	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\72b347b9990d06d8a72c66deed69a6ec14159cd6cb46ec23b202757e885b4e4a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\72b347b9990d06d8a72c66deed69a6ec14159cd6cb46ec23b202757e885b4e4a.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:520
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 520 -s 228
    3⤵
    - Program crash
    PID:480

memory/520-55-0x0000000074FD1000-0x0000000074FD3000-memory.dmp

Filesize
8KB

Download