ad93e037fa69cb66bd757866fd38ed0eab0db89541b4739c302aec7e797f5ec4

Analysis

max time kernel
253s
max time network
409s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
12/02/2023, 16:50

Target

32bit/AssetsTools.dll
Size

793KB
MD5

5485e7451430ae6ae9398bc2d5ebdc00
SHA1

03e128dd41a8d8730f21548632a046c42bb57ca4
SHA256

a5874c4ff2275214f5a7293dfee63f48e986629bce81e38fc04ef9bae21822c2
SHA512

cb3439748f4eb7f407a2640601de6249ae10bbafe6a005bc29fb9821d067d30570e48c93b24ba89b2aeb532328efdaff629312efc713756dfbf407b0ec47e93d
SSDEEP

12288:/qCAyjEMNxOit3ccD+Jg0yIjMnty8BfqxDkYj41EjqCcyqUb31/ryQT:Ao3Oy/RZnty8BfqxDkYU1ETx/ryQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1408	1100	WerFault.exe	26

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 1100	1420	rundll32.exe	26
PID 1420 wrote to memory of 1100	1420	rundll32.exe	26
PID 1420 wrote to memory of 1100	1420	rundll32.exe	26
PID 1420 wrote to memory of 1100	1420	rundll32.exe	26
PID 1420 wrote to memory of 1100	1420	rundll32.exe	26
PID 1420 wrote to memory of 1100	1420	rundll32.exe	26
PID 1420 wrote to memory of 1100	1420	rundll32.exe	26
PID 1100 wrote to memory of 1408	1100	rundll32.exe	27
PID 1100 wrote to memory of 1408	1100	rundll32.exe	27
PID 1100 wrote to memory of 1408	1100	rundll32.exe	27
PID 1100 wrote to memory of 1408	1100	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\32bit\AssetsTools.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\32bit\AssetsTools.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 224
    3⤵
    - Program crash
    PID:1408

memory/1100-55-0x00000000753F1000-0x00000000753F3000-memory.dmp

Filesize
8KB

Download