3081c8b9af41c7f340551781cd6484e442b815db0539d749e7af09183a95efd2

Resubmissions

10-01-2023 03:11

09-01-2023 22:26

max time kernel
43s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
09-01-2023 22:26

Target

3081c8b9af41c7f340551781cd6484e442b815db0539d749e7af09183a95efd2.dll
Size

36KB
MD5

8d14a834aa36163d0f57558a20187a64
SHA1

4441d9e025448cde2a405e4d217a58720161ddee
SHA256

3081c8b9af41c7f340551781cd6484e442b815db0539d749e7af09183a95efd2
SHA512

008920bddf62b1eafdbc5a4fcfb437b1d48ea1ab65b7f7643c54ce91d477fc82dcf4e9685a690316df6fa47d0a002d78badafbef85cc2dd0ad55bf57f41478af
SSDEEP

192:6P+nM5KC/zxayGc3gzq7YjDaqzJCueT+RfbZne9s6PL2P0tkYGijYW:s5Jxayczq7Yjt9lfle9s6PLO6kYGi8W

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2004 1948 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2004	1948	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1948 wrote to memory of 2004	1948	rundll32.exe	WerFault.exe
PID 1948 wrote to memory of 2004	1948	rundll32.exe	WerFault.exe
PID 1948 wrote to memory of 2004	1948	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3081c8b9af41c7f340551781cd6484e442b815db0539d749e7af09183a95efd2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1948

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1948 -s 56
2⤵
- Program crash
PID:2004