41d61ad0eee7039abbbdcaaeebb41afe28c2989cc1c1dd704c758a8f4991cb1c

Analysis

max time kernel
44s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07/12/2022, 01:18

Target

41d61ad0eee7039abbbdcaaeebb41afe28c2989cc1c1dd704c758a8f4991cb1c.dll
Size

180KB
MD5

1e227951609e8e3947f5cbb5deb525aa
SHA1

8588244ae560d8954f10372e0069aa186cd19628
SHA256

41d61ad0eee7039abbbdcaaeebb41afe28c2989cc1c1dd704c758a8f4991cb1c
SHA512

2285e8dbe6a800ba1f26a1618588bbed1caf6986da150f73b21556dc416b8ae68a931c946b7809c350e6b15415496ff455673a1fbc5376a683d96d4ac841fd0f
SSDEEP

3072:4iKtV/UqhUh/+le4Q2rBdBMAiOiZ2tSgT:4fV/UqhU8lBBdBMdJT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1120	816	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 816	1464	rundll32.exe	27
PID 1464 wrote to memory of 816	1464	rundll32.exe	27
PID 1464 wrote to memory of 816	1464	rundll32.exe	27
PID 1464 wrote to memory of 816	1464	rundll32.exe	27
PID 1464 wrote to memory of 816	1464	rundll32.exe	27
PID 1464 wrote to memory of 816	1464	rundll32.exe	27
PID 1464 wrote to memory of 816	1464	rundll32.exe	27
PID 816 wrote to memory of 1120	816	rundll32.exe	28
PID 816 wrote to memory of 1120	816	rundll32.exe	28
PID 816 wrote to memory of 1120	816	rundll32.exe	28
PID 816 wrote to memory of 1120	816	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\41d61ad0eee7039abbbdcaaeebb41afe28c2989cc1c1dd704c758a8f4991cb1c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\41d61ad0eee7039abbbdcaaeebb41afe28c2989cc1c1dd704c758a8f4991cb1c.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:816
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 816 -s 228
    3⤵
    - Program crash
    PID:1120

memory/816-55-0x00000000758B1000-0x00000000758B3000-memory.dmp

Filesize
8KB

Download