288f69a28574e77f3520a58b6cd8a355d0f961674b25b8757843600d0ddb06d6

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
15/02/2023, 07:50

Target

a462f77ec30da4687664618247d2d2735cdf3dd9aa0f8cd9f9c4abb9015c6b5f.dll
Size

448KB
MD5

7c69f6a5d73dd28444578b8b09d39e22
SHA1

f7df0646bb908a73cb8c0016b1841d3d601a81c0
SHA256

a462f77ec30da4687664618247d2d2735cdf3dd9aa0f8cd9f9c4abb9015c6b5f
SHA512

733c7198d5e60ddc9d82dfb0bba4dc71e9bc2c00a752577d02cc4537fc038d0a6e051d615cd7aafee63329409cafb74a1b894a52823e1ced53d3686c3f395e94
SSDEEP

6144:cJZRRRe1q7wXT1BakCSLdzOr2ewln8V7zDaVtfCvVBKR7fh1TiIBNYrIIg0a2M4n:cJZ701nXT1BaB4Irm8VGfn1N2g52MTA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2012	1928	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 1928	1996	rundll32.exe	28
PID 1996 wrote to memory of 1928	1996	rundll32.exe	28
PID 1996 wrote to memory of 1928	1996	rundll32.exe	28
PID 1996 wrote to memory of 1928	1996	rundll32.exe	28
PID 1996 wrote to memory of 1928	1996	rundll32.exe	28
PID 1996 wrote to memory of 1928	1996	rundll32.exe	28
PID 1996 wrote to memory of 1928	1996	rundll32.exe	28
PID 1928 wrote to memory of 2012	1928	rundll32.exe	29
PID 1928 wrote to memory of 2012	1928	rundll32.exe	29
PID 1928 wrote to memory of 2012	1928	rundll32.exe	29
PID 1928 wrote to memory of 2012	1928	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a462f77ec30da4687664618247d2d2735cdf3dd9aa0f8cd9f9c4abb9015c6b5f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a462f77ec30da4687664618247d2d2735cdf3dd9aa0f8cd9f9c4abb9015c6b5f.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1928
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 224
    3⤵
    - Program crash
    PID:2012

memory/1928-55-0x0000000076031000-0x0000000076033000-memory.dmp

Filesize
8KB

Download