e9c8a6958aa7d3d417fb48d8bdc9efe464cbb4bcd4a5faeaa742e574d254b8be

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/02/2023, 08:08

Target

d7f27bcd068821e3b541ffcc181509ab84636aec7f800c709c91b59c0795e95c.dll
Size

720KB
MD5

0cc5d5ce37dc79ee687c1e6b04c9ac6f
SHA1

8ad71d0e26666455e688c0f4d8d634a16bedc0f1
SHA256

d7f27bcd068821e3b541ffcc181509ab84636aec7f800c709c91b59c0795e95c
SHA512

34a0d2d399a5f819175a16324a2583fbcf6ea7a8ccd4ac5dc1b7a5c21b307b303e2878b6134a660188077764035990abef36b7f107145240c1194d8591f6cab0
SSDEEP

12288:9qwFxm3G6H4RyuHbR1MxnuTV/iV1SdURA8s2Q5Qp:QwFxm3G6H4IuHbR1MxnuTV/iV1QTQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1584	1720	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 1720	1752	rundll32.exe	27
PID 1752 wrote to memory of 1720	1752	rundll32.exe	27
PID 1752 wrote to memory of 1720	1752	rundll32.exe	27
PID 1752 wrote to memory of 1720	1752	rundll32.exe	27
PID 1752 wrote to memory of 1720	1752	rundll32.exe	27
PID 1752 wrote to memory of 1720	1752	rundll32.exe	27
PID 1752 wrote to memory of 1720	1752	rundll32.exe	27
PID 1720 wrote to memory of 1584	1720	rundll32.exe	28
PID 1720 wrote to memory of 1584	1720	rundll32.exe	28
PID 1720 wrote to memory of 1584	1720	rundll32.exe	28
PID 1720 wrote to memory of 1584	1720	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d7f27bcd068821e3b541ffcc181509ab84636aec7f800c709c91b59c0795e95c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d7f27bcd068821e3b541ffcc181509ab84636aec7f800c709c91b59c0795e95c.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 228
    3⤵
    - Program crash
    PID:1584

memory/1720-55-0x0000000075111000-0x0000000075113000-memory.dmp

Filesize
8KB

Download