19445d47b6904e3ce904e119ae583d286b6d2c001161b598f5c3ce2e64485792

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
10-01-2023 05:13

Target

Inv_162_Jan-01_Copy/eveeftwedK/blessing.dll
Size

788KB
MD5

15dd0873cb6bef0c8e89a0319a202c3a
SHA1

6b49af73134d502d35d81cb978075761dc3b71fa
SHA256

180bc8d0f85146d6d16fa8079e38ca5e84756f1e201fc7259464addbaee15ff2
SHA512

3b1e4b176835eeae62e5ed4ac65b97e26b4471fba4aa0514c969fac8184fdcecaa82e7c9d286d9bec909bf72cce0c6cce6bfa6ec1a2adadb463a0584d6b8d200
SSDEEP

12288:EtsF8uXf3ER0+FFzy9SUa5Eorp//XyZXygB:l8qUR0+FFzvea//XywgB

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2032 1328 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2032	1328	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1328 wrote to memory of 2032	1328	rundll32.exe	WerFault.exe
PID 1328 wrote to memory of 2032	1328	rundll32.exe	WerFault.exe
PID 1328 wrote to memory of 2032	1328	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Inv_162_Jan-01_Copy\eveeftwedK\blessing.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1328

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1328 -s 92
2⤵
- Program crash
PID:2032