173b14b1b579add43d7434822a7513d175167c22a1cc50d8e84c63bcb9e5d572

Analysis

max time kernel
629s
max time network
635s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
17-01-2023 18:49

Target

b.dll
Size

60KB
MD5

5359ac968f7cee07ee5b28e4f77e0a9b
SHA1

4488d17610c128cf2caf2dd27dce5767c68a10b4
SHA256

173b14b1b579add43d7434822a7513d175167c22a1cc50d8e84c63bcb9e5d572
SHA512

983db64d91d8e80899ad28b56087af8912943d2f7517db7cde9209c7d168460ba26050ce691a492e36e9a112416bce644414fa7d316594af90b3c3d1d2bb1cc3
SSDEEP

768:hO4apg9TJD/UFPvh45g1WmxValWf5uJMj9TX8Tlpd76o1x6:hHT+4mjw4OdZx

Score

3^/10

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1140	1580	WerFault.exe	7
1772	1824	WerFault.exe	31
1868	340	WerFault.exe	33

Suspicious behavior: CmdExeWriteProcessMemorySpam 2 IoCs

pid	Process
1824	regsvr32.exe
340	regsvr32.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 1140	1580	rundll32.exe	28
PID 1580 wrote to memory of 1140	1580	rundll32.exe	28
PID 1580 wrote to memory of 1140	1580	rundll32.exe	28
PID 1188 wrote to memory of 1824	1188	cmd.exe	31
PID 1188 wrote to memory of 1824	1188	cmd.exe	31
PID 1188 wrote to memory of 1824	1188	cmd.exe	31
PID 1188 wrote to memory of 1824	1188	cmd.exe	31
PID 1188 wrote to memory of 1824	1188	cmd.exe	31
PID 1824 wrote to memory of 1772	1824	regsvr32.exe	32
PID 1824 wrote to memory of 1772	1824	regsvr32.exe	32
PID 1824 wrote to memory of 1772	1824	regsvr32.exe	32
PID 1188 wrote to memory of 340	1188	cmd.exe	33
PID 1188 wrote to memory of 340	1188	cmd.exe	33
PID 1188 wrote to memory of 340	1188	cmd.exe	33
PID 1188 wrote to memory of 340	1188	cmd.exe	33
PID 1188 wrote to memory of 340	1188	cmd.exe	33
PID 340 wrote to memory of 1868	340	regsvr32.exe	34
PID 340 wrote to memory of 1868	340	regsvr32.exe	34
PID 340 wrote to memory of 1868	340	regsvr32.exe	34

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1580 -s 56
  2⤵
  - Program crash
  PID:1140

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Windows\system32\regsvr32.exe
  regsvr32 b.dll
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:1824
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 1824 -s 220
    3⤵
    - Program crash
    PID:1772
- C:\Windows\system32\regsvr32.exe
  regsvr32 /s b.dll
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:340
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 340 -s 220
    3⤵
    - Program crash
    PID:1868

memory/1824-56-0x000007FEFBEE1000-0x000007FEFBEE3000-memory.dmp

Filesize
8KB

Download