476e834197ac6cd3080059d86a8a2a49e31212ed75e0d68e4e21fcc3bc6b1d8b

Analysis

max time kernel
48s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
14/02/2023, 12:31

Target
187737.dat.dll
Size 771KB
Sample230214-pp2qeacf8x
SHA256 476e834197ac6cd3080059d86a8a2a49e31212ed75e0d68e4e21fcc3bc6b1d8b
MD5 ac377cea30d0b6227c70ae0ef6871f71
SHA1 1223a42bea918585ed4ea77e6c8ad9b3f151e2a7
SHA512 a485d993902673aeeb0cecf57f1fb3d0b0f5c24d11dc769831be6f2ad48024c5d1fe088629befd75f281154df99721e414fe45a57a376a364af7637ea19d0cd7
SSDEEP 24576:/H81smt4vyVjXe1ikZdtjMsc7MscXMscktkTNd8uB:kefBtkf8
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1148	1532	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 1532	1460	rundll32.exe	27
PID 1460 wrote to memory of 1532	1460	rundll32.exe	27
PID 1460 wrote to memory of 1532	1460	rundll32.exe	27
PID 1460 wrote to memory of 1532	1460	rundll32.exe	27
PID 1460 wrote to memory of 1532	1460	rundll32.exe	27
PID 1460 wrote to memory of 1532	1460	rundll32.exe	27
PID 1460 wrote to memory of 1532	1460	rundll32.exe	27
PID 1532 wrote to memory of 1148	1532	rundll32.exe	28
PID 1532 wrote to memory of 1148	1532	rundll32.exe	28
PID 1532 wrote to memory of 1148	1532	rundll32.exe	28
PID 1532 wrote to memory of 1148	1532	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\187737.dat.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\187737.dat.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 252
    3⤵
    - Program crash
    PID:1148

memory/1532-55-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Download