be443555adde2329d2e6392b6549c3856fa0ab250f3e56798e91044c1cd95751

Analysis

max time kernel
40s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 11:23

Target
a/unedifying.dll
Size 269KB
Sample221206-ng89vach59
SHA256 c7d63b44ed478fe48468ddee84beb324712b22602b8c8a1ee2de75445f18528e
MD5 012da0b3ac0042942cd3b37915e799ba
SHA1 848ec6dadfd86129908bf5cf51e34fb1d0e3ca62
SHA512 bc5f4f3940035a71d810692c65dbec81c3344f6a454c4b6cf666286edbeda737fdfdb962e7009d32a37a02476424c98605b7a054b312ca9f0b47168e8bc0948c
SSDEEP 6144:mTHJ5BU2WigC+/NZy40onBV14xjN8IcOzECLZ:8DB0igC+/NHBV1SjaCd
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
912	1692	WerFault.exe	12

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1692	rundll32.exe
1692	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 912	1692	rundll32.exe	27
PID 1692 wrote to memory of 912	1692	rundll32.exe	27
PID 1692 wrote to memory of 912	1692	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a\unedifying.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1692 -s 152
  2⤵
  - Program crash
  PID:912