f5ae263677affd76211e6b7645f8f1c6e40812ad714a556b2ba8330cbed3972e

Analysis

max time kernel
3s
max time network
40s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 05:50

Target

f5ae263677affd76211e6b7645f8f1c6e40812ad714a556b2ba8330cbed3972e.dll
Size

76KB
MD5

432dc913eb0af9a1eebd9c00a14ad9e0
SHA1

7696aa9e2187fc1c8526473f25e1a943e22f18a0
SHA256

f5ae263677affd76211e6b7645f8f1c6e40812ad714a556b2ba8330cbed3972e
SHA512

c1d78d7f56f15bd462bb46a520ea8a231fd09b7f3389f16674bff078eaa5a8389cbaae562f0dbfc2cc4eb8b71251f655be87c8c0607ac4b0a452c7d8752fc061
SSDEEP

768:XyEPKVrhnFjiWmmYat2nm8EppbZAK9JXo2Hc+jJIWwt8qydMJzGQNUx:iIKBfvtimLg28SJNwtfydaGQNU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1340	956	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 956	2008	rundll32.exe	28
PID 2008 wrote to memory of 956	2008	rundll32.exe	28
PID 2008 wrote to memory of 956	2008	rundll32.exe	28
PID 2008 wrote to memory of 956	2008	rundll32.exe	28
PID 2008 wrote to memory of 956	2008	rundll32.exe	28
PID 2008 wrote to memory of 956	2008	rundll32.exe	28
PID 2008 wrote to memory of 956	2008	rundll32.exe	28
PID 956 wrote to memory of 1340	956	rundll32.exe	29
PID 956 wrote to memory of 1340	956	rundll32.exe	29
PID 956 wrote to memory of 1340	956	rundll32.exe	29
PID 956 wrote to memory of 1340	956	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f5ae263677affd76211e6b7645f8f1c6e40812ad714a556b2ba8330cbed3972e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f5ae263677affd76211e6b7645f8f1c6e40812ad714a556b2ba8330cbed3972e.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:956
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 956 -s 228
    3⤵
    - Program crash
    PID:1340

memory/956-54-0x0000000000000000-mapping.dmp

Download
memory/956-55-0x00000000767F1000-0x00000000767F3000-memory.dmp

Filesize
8KB

Download
memory/1340-56-0x0000000000000000-mapping.dmp

Download