9919791ec9bcb0a83cb6ecad072ee876ab43fbbd334b7bce21d6500edb2fbada

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
10/01/2023, 20:01

Target

9919791ec9bcb0a83cb6ecad072ee876ab43fbbd334b7bce21d6500edb2fbada.dll
Size

161KB
MD5

f64d275cedc4958495357390f4e025d4
SHA1

167b72a28b33e4c400ef117a5b6ead3777b6071e
SHA256

9919791ec9bcb0a83cb6ecad072ee876ab43fbbd334b7bce21d6500edb2fbada
SHA512

7c2af2764339cdf9668068bad3f94324756f26f20e8db8933be539efb4bb228a69ff24e6a16d8466e72a20116f2ab5ea5a57074933d0fd6f294c4062ef1cb1eb
SSDEEP

3072:5T64VoI67r1d8eLlvJ9YTBj1BQEauAbV+tEn5J/NRsgCX/X/amtT:5T6tdd8klfYVXQwAbln52lXn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1104	892	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 656 wrote to memory of 892	656	rundll32.exe	27
PID 656 wrote to memory of 892	656	rundll32.exe	27
PID 656 wrote to memory of 892	656	rundll32.exe	27
PID 656 wrote to memory of 892	656	rundll32.exe	27
PID 656 wrote to memory of 892	656	rundll32.exe	27
PID 656 wrote to memory of 892	656	rundll32.exe	27
PID 656 wrote to memory of 892	656	rundll32.exe	27
PID 892 wrote to memory of 1104	892	rundll32.exe	28
PID 892 wrote to memory of 1104	892	rundll32.exe	28
PID 892 wrote to memory of 1104	892	rundll32.exe	28
PID 892 wrote to memory of 1104	892	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9919791ec9bcb0a83cb6ecad072ee876ab43fbbd334b7bce21d6500edb2fbada.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9919791ec9bcb0a83cb6ecad072ee876ab43fbbd334b7bce21d6500edb2fbada.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 892 -s 332
    3⤵
    - Program crash
    PID:1104

memory/892-55-0x0000000075131000-0x0000000075133000-memory.dmp

Filesize
8KB

Download
memory/892-57-0x0000000010000000-0x0000000010060000-memory.dmp

Filesize
384KB

Download