2278026ebff5df923bb074305062a16e886a79a93ee0b1f73f60a482e1ebd30e

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
16-02-2023 20:54

Target

2278026ebff5df923bb074305062a16e886a79a93ee0b1f73f60a482e1ebd30e.dll
Size

1006KB
MD5

ca83768a634ca137bed49f7cb4cc1ee8
SHA1

aa9b204d1efcffe12dc10ec596299bf18b90064a
SHA256

2278026ebff5df923bb074305062a16e886a79a93ee0b1f73f60a482e1ebd30e
SHA512

d307468d09c14a714e62902519376e11d75f32f7f86034d108edd3682f08d692aa6b7750a6f8a3efa5c51a072d2f7eba57bb6756a7693912e5f33663446aa7c6
SSDEEP

24576:XnXzw0eNlVIj5Auqy8ixlMKOJLKEmC0RDUSIdE9iS:XncjyGjy8xbJlmZvQE9f

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1196 1332 WerFault.exe rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

1332 rundll32.exe

pid	pid_target	process	target process
1196	1332	WerFault.exe	rundll32.exe

pid	process
1332	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1272 wrote to memory of 1332	1272	rundll32.exe	rundll32.exe
PID 1272 wrote to memory of 1332	1272	rundll32.exe	rundll32.exe
PID 1272 wrote to memory of 1332	1272	rundll32.exe	rundll32.exe
PID 1272 wrote to memory of 1332	1272	rundll32.exe	rundll32.exe
PID 1272 wrote to memory of 1332	1272	rundll32.exe	rundll32.exe
PID 1272 wrote to memory of 1332	1272	rundll32.exe	rundll32.exe
PID 1272 wrote to memory of 1332	1272	rundll32.exe	rundll32.exe
PID 1332 wrote to memory of 1196	1332	rundll32.exe	WerFault.exe
PID 1332 wrote to memory of 1196	1332	rundll32.exe	WerFault.exe
PID 1332 wrote to memory of 1196	1332	rundll32.exe	WerFault.exe
PID 1332 wrote to memory of 1196	1332	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2278026ebff5df923bb074305062a16e886a79a93ee0b1f73f60a482e1ebd30e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 360
3⤵
- Program crash
PID:1196

memory/1196-60-0x0000000000000000-mapping.dmp

Download
memory/1332-54-0x0000000000000000-mapping.dmp

Download
memory/1332-55-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/1332-56-0x0000000002040000-0x00000000023B1000-memory.dmp

Filesize
3.4MB

Download
memory/1332-57-0x0000000002040000-0x00000000023B1000-memory.dmp

Filesize
3.4MB

Download
memory/1332-58-0x0000000002040000-0x00000000023B1000-memory.dmp

Filesize
3.4MB

Download
memory/1332-59-0x0000000002040000-0x00000000023B1000-memory.dmp

Filesize
3.4MB

Download
memory/1332-61-0x0000000002040000-0x00000000023B1000-memory.dmp

Filesize
3.4MB

Download