97cbec0b009865692bb838cacbedd70715034dadc1c9b9516d72670afb6f0718

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 09:04

Target

97cbec0b009865692bb838cacbedd70715034dadc1c9b9516d72670afb6f0718.dll
Size

131KB
MD5

757c118065ef12fefcf5ff8629c40d82
SHA1

42f2b7705ded8a3cc3dc107eda55b6235349da38
SHA256

97cbec0b009865692bb838cacbedd70715034dadc1c9b9516d72670afb6f0718
SHA512

d98dec803480cbe77214a5163249b3aba6664a3e1e24ceb5ee5c4c53068cc78052f1f19396838d911f66911ace68775889d583918a8c1e6dea4b69d5a5b39523
SSDEEP

1536:wdqyQ+lpvRufBnrt931naFOpBlHaOG9BsOgceWPKCnD8BUk35WoVYRYazgJWJSK4:oFlxidt9DDP9bWyCQJiWEw/wPfc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1996	1872	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 1872	1168	rundll32.exe	27
PID 1168 wrote to memory of 1872	1168	rundll32.exe	27
PID 1168 wrote to memory of 1872	1168	rundll32.exe	27
PID 1168 wrote to memory of 1872	1168	rundll32.exe	27
PID 1168 wrote to memory of 1872	1168	rundll32.exe	27
PID 1168 wrote to memory of 1872	1168	rundll32.exe	27
PID 1168 wrote to memory of 1872	1168	rundll32.exe	27
PID 1872 wrote to memory of 1996	1872	rundll32.exe	28
PID 1872 wrote to memory of 1996	1872	rundll32.exe	28
PID 1872 wrote to memory of 1996	1872	rundll32.exe	28
PID 1872 wrote to memory of 1996	1872	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\97cbec0b009865692bb838cacbedd70715034dadc1c9b9516d72670afb6f0718.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\97cbec0b009865692bb838cacbedd70715034dadc1c9b9516d72670afb6f0718.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 276
    3⤵
    - Program crash
    PID:1996

memory/1872-54-0x0000000000000000-mapping.dmp

Download
memory/1872-55-0x0000000075571000-0x0000000075573000-memory.dmp

Filesize
8KB

Download
memory/1872-56-0x0000000000170000-0x0000000000196000-memory.dmp

Filesize
152KB

Download
memory/1996-57-0x0000000000000000-mapping.dmp

Download