871ae5b567e478dd9a5f3601f24758d1315f38b659497a9bda3c701776fc8409

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
22-12-2022 14:04

Target

469e06adc60ffd19490a9fe561ceff99cc5c8ce5b0ddb652a24acd03265c0c65.dll
Size

8.3MB
MD5

d6340fd7927ba1ecc8b8dca640cc7998
SHA1

fd6570f966b3b39ee7664336ae8a4d12c9a8d414
SHA256

469e06adc60ffd19490a9fe561ceff99cc5c8ce5b0ddb652a24acd03265c0c65
SHA512

b9000ca6fa9f3ee9c0ddac05569d8f881c95217baf2fe730f94e140dfecf438fe6c35f148ae910a3175e524a673fefc17a25c6e71aeb94a627f78fd3399ba3fc
SSDEEP

49152:8SFvrQJFY83N4qsYiGsiEnaZQTCBjDpN+v0Bkl7CqfaJDJk/SET9y2zkp:5cJ12xG8a+TWPpNG669DQp

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2040 1184 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2040	1184	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1784 wrote to memory of 1184	1784	rundll32.exe	rundll32.exe
PID 1784 wrote to memory of 1184	1784	rundll32.exe	rundll32.exe
PID 1784 wrote to memory of 1184	1784	rundll32.exe	rundll32.exe
PID 1784 wrote to memory of 1184	1784	rundll32.exe	rundll32.exe
PID 1784 wrote to memory of 1184	1784	rundll32.exe	rundll32.exe
PID 1784 wrote to memory of 1184	1784	rundll32.exe	rundll32.exe
PID 1784 wrote to memory of 1184	1784	rundll32.exe	rundll32.exe
PID 1184 wrote to memory of 2040	1184	rundll32.exe	WerFault.exe
PID 1184 wrote to memory of 2040	1184	rundll32.exe	WerFault.exe
PID 1184 wrote to memory of 2040	1184	rundll32.exe	WerFault.exe
PID 1184 wrote to memory of 2040	1184	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\469e06adc60ffd19490a9fe561ceff99cc5c8ce5b0ddb652a24acd03265c0c65.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1784

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\469e06adc60ffd19490a9fe561ceff99cc5c8ce5b0ddb652a24acd03265c0c65.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1184 -s 196
3⤵
- Program crash
PID:2040

memory/1184-54-0x0000000000000000-mapping.dmp

Download
memory/1184-55-0x00000000767F1000-0x00000000767F3000-memory.dmp

Filesize
8KB

Download
memory/2040-56-0x0000000000000000-mapping.dmp

Download