d44fde0ce12cf9f55326c651d3dd6aac3d745c93c70af4376bfa6c90c9b5f950

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 11:40

Target

d44fde0ce12cf9f55326c651d3dd6aac3d745c93c70af4376bfa6c90c9b5f950.dll
Size

160KB
MD5

bf5bc6af7be58329d8d11b64e1af736f
SHA1

ac9eeecfbd839f5eeb3eb9fb22c84d82aa112e19
SHA256

d44fde0ce12cf9f55326c651d3dd6aac3d745c93c70af4376bfa6c90c9b5f950
SHA512

4c53ad7cff84d9f85eaa2129eb2691cba2be1160964e07313a4b0fb3c328ddcdc461e28e65368175dca870d3108b8943ef2a84686619eef02a082945847e9b12
SSDEEP

3072:xuhE6zRki6RcgnS892mMcYmxOHr1u/9av/CO15Y:xuht6RcDk8zlAO/C5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1280	2028	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 2028	928	rundll32.exe	27
PID 928 wrote to memory of 2028	928	rundll32.exe	27
PID 928 wrote to memory of 2028	928	rundll32.exe	27
PID 928 wrote to memory of 2028	928	rundll32.exe	27
PID 928 wrote to memory of 2028	928	rundll32.exe	27
PID 928 wrote to memory of 2028	928	rundll32.exe	27
PID 928 wrote to memory of 2028	928	rundll32.exe	27
PID 2028 wrote to memory of 1280	2028	rundll32.exe	28
PID 2028 wrote to memory of 1280	2028	rundll32.exe	28
PID 2028 wrote to memory of 1280	2028	rundll32.exe	28
PID 2028 wrote to memory of 1280	2028	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d44fde0ce12cf9f55326c651d3dd6aac3d745c93c70af4376bfa6c90c9b5f950.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d44fde0ce12cf9f55326c651d3dd6aac3d745c93c70af4376bfa6c90c9b5f950.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 272
    3⤵
    - Program crash
    PID:1280

memory/2028-55-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download