34b5fc171163cb0207f6118b48ce33e4c0c6d1728c5915d5a0b9c3da2f7e8583

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
11-01-2023 04:49

Target

request_01-10_INV-165/potyourueZ/disintoxicating.dll
Size

544KB
MD5

93787c6a5ba46605c0916be28ef52bf1
SHA1

c786205da7660fa7f76a41ed26b8d1c6aff95044
SHA256

2a07b1741dbf216a188938d0fec870f8395374f760c6bf452f0a0479e975b018
SHA512

ade7b59752508a0abffd296a4abb780238b4ad39bfcb0333ba365b43ad9886929e97f0d64ce2c8fcd6cfb32572d0342f018cd88f6e55ea0822096eeedf5b8e4c
SSDEEP

12288:MZF4/8HxyNNCt+sULxQx2SWqj4PWyfEWmxa+o:Mk/CoAfULIHtZbo

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1720 1096 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1720	1096	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1096 wrote to memory of 1720	1096	rundll32.exe	WerFault.exe
PID 1096 wrote to memory of 1720	1096	rundll32.exe	WerFault.exe
PID 1096 wrote to memory of 1720	1096	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\request_01-10_INV-165\potyourueZ\disintoxicating.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1096

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1096 -s 84
2⤵
- Program crash
PID:1720