90c1c2de9cfbc697d463ac72e737876ce279a557847e61a0d476aebf025c3883

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/01/2023, 03:04

Target

90c1c2de9cfbc697d463ac72e737876ce279a557847e61a0d476aebf025c3883.dll
Size

1.3MB
MD5

a71586ff5fd22eb86faa0d413d1784fd
SHA1

97e7308276f026db32ff2147f80789c54d01786d
SHA256

90c1c2de9cfbc697d463ac72e737876ce279a557847e61a0d476aebf025c3883
SHA512

d7d825c81f8417226e6f75d64942594bd41ecc29bc1293bab04775cee0b1d535c90edfdc916a22c9b2163df02b21da746416a60bcadca25669a2537b87290df1
SSDEEP

24576:zbDWj31mG/e/EC3U7Ok3bvFvT3MoQtqHlsbCzAgI2lZ9KJE2VzP:bQSRk3bvFvT35QtqH+ysEczP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1696	2032	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2032	2012	rundll32.exe	28
PID 2012 wrote to memory of 2032	2012	rundll32.exe	28
PID 2012 wrote to memory of 2032	2012	rundll32.exe	28
PID 2012 wrote to memory of 2032	2012	rundll32.exe	28
PID 2012 wrote to memory of 2032	2012	rundll32.exe	28
PID 2012 wrote to memory of 2032	2012	rundll32.exe	28
PID 2012 wrote to memory of 2032	2012	rundll32.exe	28
PID 2032 wrote to memory of 1696	2032	rundll32.exe	29
PID 2032 wrote to memory of 1696	2032	rundll32.exe	29
PID 2032 wrote to memory of 1696	2032	rundll32.exe	29
PID 2032 wrote to memory of 1696	2032	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\90c1c2de9cfbc697d463ac72e737876ce279a557847e61a0d476aebf025c3883.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\90c1c2de9cfbc697d463ac72e737876ce279a557847e61a0d476aebf025c3883.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 308
    3⤵
    - Program crash
    PID:1696

memory/2032-55-0x00000000763A1000-0x00000000763A3000-memory.dmp

Filesize
8KB

Download
memory/2032-56-0x00000000005C0000-0x000000000070A000-memory.dmp

Filesize
1.3MB

Download