5a84a6811fea2dcac2dc50fd85ed24914d6ed5f8482b3365a62ae894298a19fc

Analysis

max time kernel
79s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
07-12-2022 16:28

Target

5a84a6811fea2dcac2dc50fd85ed24914d6ed5f8482b3365a62ae894298a19fc.dll
Size

159KB
MD5

eae620e8d73cf7622f2678d48acd2987
SHA1

55c9835006895bae67eb6c15051f3e090e9ef31d
SHA256

5a84a6811fea2dcac2dc50fd85ed24914d6ed5f8482b3365a62ae894298a19fc
SHA512

0df0cb57d4058017384ecd3d38fd4aa190a437a4d322d2de47163a12a8bac7f9affad9fc6f7306cd39ece8e4b5700e4e05d35fe4df6068762abfeaed5ad5b873
SSDEEP

3072:ngikbXp3BvScvqzzxVvAAWJ6AzHHTBfZSMO/yapv:YTdRXvqXxh1WJJzHHTBRSX/

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1112 1176 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

1176 rundll32.exe

pid	pid_target	process	target process
1112	1176	WerFault.exe	rundll32.exe

pid	process
1176	rundll32.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1220 wrote to memory of 1176	1220	rundll32.exe	rundll32.exe
PID 1220 wrote to memory of 1176	1220	rundll32.exe	rundll32.exe
PID 1220 wrote to memory of 1176	1220	rundll32.exe	rundll32.exe
PID 1220 wrote to memory of 1176	1220	rundll32.exe	rundll32.exe
PID 1220 wrote to memory of 1176	1220	rundll32.exe	rundll32.exe
PID 1220 wrote to memory of 1176	1220	rundll32.exe	rundll32.exe
PID 1220 wrote to memory of 1176	1220	rundll32.exe	rundll32.exe
PID 1176 wrote to memory of 268	1176	rundll32.exe	wermgr.exe
PID 1176 wrote to memory of 268	1176	rundll32.exe	wermgr.exe
PID 1176 wrote to memory of 268	1176	rundll32.exe	wermgr.exe
PID 1176 wrote to memory of 268	1176	rundll32.exe	wermgr.exe
PID 1176 wrote to memory of 1112	1176	rundll32.exe	WerFault.exe
PID 1176 wrote to memory of 1112	1176	rundll32.exe	WerFault.exe
PID 1176 wrote to memory of 1112	1176	rundll32.exe	WerFault.exe
PID 1176 wrote to memory of 1112	1176	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a84a6811fea2dcac2dc50fd85ed24914d6ed5f8482b3365a62ae894298a19fc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1176 -s 360
3⤵
- Program crash
PID:1112

memory/1112-56-0x0000000000000000-mapping.dmp

Download
memory/1176-54-0x0000000000000000-mapping.dmp

Download
memory/1176-55-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download