5f919b98fe0692407761b9fbc869cfd47cecf3d7386ae340a16f04af4673c2ba

Analysis

max time kernel
1s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/02/2023, 19:08

Target

040aecd723be3d1660473cf075c641d80f3ea19e.dll
Size

1.7MB
MD5

37c3245c8ae6b76f1394210ed66af190
SHA1

040aecd723be3d1660473cf075c641d80f3ea19e
SHA256

5f919b98fe0692407761b9fbc869cfd47cecf3d7386ae340a16f04af4673c2ba
SHA512

1aaeb3c08c4a71d93c8f5f007c543c0164e1071113cb29033d4fe2c8fd2a36c6115bd121d877d6da471014656866208599734bef99f6a5d4f496658d301b4acc
SSDEEP

24576:zrj3nPW3ednWPiT8VTBqcATV8KIyydLXGcq8z+0uaEYmgEJ/tc1:T3nCeCiT8aHxyM18z+XatEJ1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
820	1252	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 1252	1232	rundll32.exe	28
PID 1232 wrote to memory of 1252	1232	rundll32.exe	28
PID 1232 wrote to memory of 1252	1232	rundll32.exe	28
PID 1232 wrote to memory of 1252	1232	rundll32.exe	28
PID 1232 wrote to memory of 1252	1232	rundll32.exe	28
PID 1232 wrote to memory of 1252	1232	rundll32.exe	28
PID 1232 wrote to memory of 1252	1232	rundll32.exe	28
PID 1252 wrote to memory of 820	1252	rundll32.exe	29
PID 1252 wrote to memory of 820	1252	rundll32.exe	29
PID 1252 wrote to memory of 820	1252	rundll32.exe	29
PID 1252 wrote to memory of 820	1252	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\040aecd723be3d1660473cf075c641d80f3ea19e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\040aecd723be3d1660473cf075c641d80f3ea19e.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 228
    3⤵
    - Program crash
    PID:820

memory/1252-55-0x0000000075991000-0x0000000075993000-memory.dmp

Filesize
8KB

Download