6ecff9d04bda4d4149f1a78486ede32e15a36b9d94fce5509467b3af1feede01

Analysis

max time kernel
10s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
15-12-2022 17:16

Target

VirtualBox-7.0.2-154219-Win/x86/CoolType.dll
Size

3.2MB
MD5

6fb9f15b6a1dd1ee9cdb9b4ef290d69e
SHA1

c5955655e9b96004a72bbb09aa72996f3ddaa539
SHA256

d4a0db913fa555808ce627114fe6e2725970499c70364edbedf47d907d52242d
SHA512

24be26d2e0dc3e05f786ce3eee815247261fe99e1bff08e689d71bf68e7d5340e942aaaefd9203569f63c23a5f5cb46c1ff6a2d91f2753fd6d78240fffa7beed
SSDEEP

49152:37sVoVC47fsPVTs57ovd2MMg6NYpnd3EQUyfha+P/u6LSXvowU7u9qRXApP4Cqrt:37RCwfsdTk+dlb73ELyfhlf9K4Cqi3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2020	2036	WerFault.exe	26

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2036	2012	rundll32.exe	26
PID 2012 wrote to memory of 2036	2012	rundll32.exe	26
PID 2012 wrote to memory of 2036	2012	rundll32.exe	26
PID 2012 wrote to memory of 2036	2012	rundll32.exe	26
PID 2012 wrote to memory of 2036	2012	rundll32.exe	26
PID 2012 wrote to memory of 2036	2012	rundll32.exe	26
PID 2012 wrote to memory of 2036	2012	rundll32.exe	26
PID 2036 wrote to memory of 2020	2036	rundll32.exe	27
PID 2036 wrote to memory of 2020	2036	rundll32.exe	27
PID 2036 wrote to memory of 2020	2036	rundll32.exe	27
PID 2036 wrote to memory of 2020	2036	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VirtualBox-7.0.2-154219-Win\x86\CoolType.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\VirtualBox-7.0.2-154219-Win\x86\CoolType.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 224
    3⤵
    - Program crash
    PID:2020

memory/2036-55-0x0000000075911000-0x0000000075913000-memory.dmp

Filesize
8KB

Download