9bacbe6aa854abb9a0f8bfda9692e0f39f910c050158444f4eada541764abc19

Analysis

max time kernel
35s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 19:54

Target

9bacbe6aa854abb9a0f8bfda9692e0f39f910c050158444f4eada541764abc19.dll
Size

19KB
MD5

f8334cbe4aa14216d87298aaf6de82b5
SHA1

f4ff436b40319e317bb022c97ea6b5a24a87486c
SHA256

9bacbe6aa854abb9a0f8bfda9692e0f39f910c050158444f4eada541764abc19
SHA512

509a656d2bddc8871826cba1c932597b6d9232aef8a65d96b9191b7b1e5e9bafb32832b709ad7bcb80c630ae7a8b1578e6f5441a51f3cce40270326d07db3e61
SSDEEP

384:x9OFjwW3eBW80Whv3LSc67O1Hi6Tbg1N+iqJLL8V1hwHoLKZ/hNYQgA:TiX3l808Lg74HJmNTgUVDwZyQg

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\RemoteDbg.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\RemoteDbg.dll	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
316	292	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
292	rundll32.exe
292	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 292	1884	rundll32.exe	28
PID 1884 wrote to memory of 292	1884	rundll32.exe	28
PID 1884 wrote to memory of 292	1884	rundll32.exe	28
PID 1884 wrote to memory of 292	1884	rundll32.exe	28
PID 1884 wrote to memory of 292	1884	rundll32.exe	28
PID 1884 wrote to memory of 292	1884	rundll32.exe	28
PID 1884 wrote to memory of 292	1884	rundll32.exe	28
PID 292 wrote to memory of 316	292	rundll32.exe	29
PID 292 wrote to memory of 316	292	rundll32.exe	29
PID 292 wrote to memory of 316	292	rundll32.exe	29
PID 292 wrote to memory of 316	292	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9bacbe6aa854abb9a0f8bfda9692e0f39f910c050158444f4eada541764abc19.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9bacbe6aa854abb9a0f8bfda9692e0f39f910c050158444f4eada541764abc19.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:292
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 292 -s 224
    3⤵
    - Program crash
    PID:316

memory/292-55-0x0000000076941000-0x0000000076943000-memory.dmp

Filesize
8KB

Download
memory/292-57-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download