b58a31d34c5014ac5f41d7ecd5a741139595ae6d05ac850a41314ff03260e4c0

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
12-12-2022 09:01

Target

iced/askgothogtan/forbidding.dll
Size

374KB
MD5

6242b580541d24a300b10998f33af74f
SHA1

091b8d919aa4d340c4872ad97488eeb7866175e6
SHA256

88b2a39578b88e560fd05ec2fcd971cf63e4fbeb229026ad5c0dc3bce17ea549
SHA512

c1ee8be83d598277d7db31e9aad0318e710e73c5a89a61fc7554e79470ff8fab637954038a4817e5da188be20741bab2c6302c1c1df97df90c5c5b36d4913d13
SSDEEP

6144:00FOhm3Y1LfpDqnkIBwcu/oDdzr88vAHL/l7ysDPXoPcTPinEgrTytlRNKIg8ggd:00km3YYY/ohhvAHLoWPXoPcTPbgrmtlR

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

944 1336 WerFault.exe rundll32.exe

pid	pid_target	process	target process
944	1336	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1336 wrote to memory of 944	1336	rundll32.exe	WerFault.exe
PID 1336 wrote to memory of 944	1336	rundll32.exe	WerFault.exe
PID 1336 wrote to memory of 944	1336	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\iced\askgothogtan\forbidding.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1336

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1336 -s 84
2⤵
- Program crash
PID:944