3c90b3d32f3fe37632edfad2b768cf77d70e7de0d3291d0e5274ea8a7dc69141

Analysis

max time kernel
39s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-02-2023 19:44

Target

Slither x32y 64/nw.dll
Size

68.0MB
MD5

4095865a5658450bb415dcbe4d854580
SHA1

6ffba25849a6a6c0df63f89653a4d79c3c553815
SHA256

a43a6dbebbea327dd5a64f051ce27b4e24cf66c7213a1de7f3a357e380c68f45
SHA512

60b2e139469e534c886b133a6fa1ad5280d29e7ffc070f169971b9619536c18da41e4bb9c048a83dd39aa421590745a909f7717c4847120be460e672a32e2183
SSDEEP

1572864:RuCwol9s/loA881aY2p6ab63gs9rHEfSoMmZMzbe75lgCSBbe8fAUTJ:RuKOhkk97EZMmZMzbe7ECk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1192	2028	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 2028	1780	rundll32.exe	28
PID 1780 wrote to memory of 2028	1780	rundll32.exe	28
PID 1780 wrote to memory of 2028	1780	rundll32.exe	28
PID 1780 wrote to memory of 2028	1780	rundll32.exe	28
PID 1780 wrote to memory of 2028	1780	rundll32.exe	28
PID 1780 wrote to memory of 2028	1780	rundll32.exe	28
PID 1780 wrote to memory of 2028	1780	rundll32.exe	28
PID 2028 wrote to memory of 1192	2028	rundll32.exe	29
PID 2028 wrote to memory of 1192	2028	rundll32.exe	29
PID 2028 wrote to memory of 1192	2028	rundll32.exe	29
PID 2028 wrote to memory of 1192	2028	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Slither x32y 64\nw.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Slither x32y 64\nw.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 324
    3⤵
    - Program crash
    PID:1192

memory/1192-56-0x0000000000000000-mapping.dmp

Download
memory/2028-54-0x0000000000000000-mapping.dmp

Download
memory/2028-55-0x00000000762F1000-0x00000000762F3000-memory.dmp

Filesize
8KB

Download