8de649768f6b70ca5ed23c2adfa2d4caa3dc2d7ef18c43e43d710a9703b1fb0b

Analysis

max time kernel
29s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
11/01/2023, 15:18

Target
b64216fe932fb3dbb9a4d4328f0671ec.dll
Size 2.9MB
Sample230111-spk97shb8z
SHA256 8de649768f6b70ca5ed23c2adfa2d4caa3dc2d7ef18c43e43d710a9703b1fb0b
MD5 b64216fe932fb3dbb9a4d4328f0671ec
SHA1 c37ac956fcfb891f95f323d4ff17a1061f05e53c
SHA512 34c66ad5361b40f13aa6f76990a73de0c4448e9fa4704b8677417c44b71ced67f572a3c34713e55703dfe3d617b2100a3147474a31443b94f54a8b0c3f10fb10
SSDEEP 49152:SUpAvB58NiycafyaC2CJtPp/DhHOw5C2RubhI:7YMnctxJb79OrG
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1184	1780	WerFault.exe	23

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 1184	1780	rundll32.exe	28
PID 1780 wrote to memory of 1184	1780	rundll32.exe	28
PID 1780 wrote to memory of 1184	1780	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b64216fe932fb3dbb9a4d4328f0671ec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1780 -s 184
  2⤵
  - Program crash
  PID:1184