61b0b6148dfb82f659edc51f0326f1ffe6db91548dceab0c05add0c5d78ab894

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
17-02-2023 20:07

Target

61b0b6148dfb82f659edc51f0326f1ffe6db91548dceab0c05add0c5d78ab894.dll
Size

1.2MB
MD5

666688dcbd999a4cf67ed3e29031b37d
SHA1

836dd9f7ddfbd2ee3f6856148ff12169ff648951
SHA256

61b0b6148dfb82f659edc51f0326f1ffe6db91548dceab0c05add0c5d78ab894
SHA512

f649c5531691f57560fe3e0cc7c05d8b95109dbacd7d164bf0d358856ff624a4c873a6bf62ea1f19753837f86f35b8d5dd76a399d91e6f3e64c1c93c11a9b8a6
SSDEEP

24576:xBDiyoaT8a0icpELVbcxiVkGf6yI4EeBDa3oU5G3isrBLTGv7IXkKhCw9gNmiME:nonULaxivf6yIf5Gp9GjIXkKs5mB

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1528 1536 WerFault.exe rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

1536 rundll32.exe

pid	pid_target	process	target process
1528	1536	WerFault.exe	rundll32.exe

pid	process
1536	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1388 wrote to memory of 1536	1388	rundll32.exe	rundll32.exe
PID 1388 wrote to memory of 1536	1388	rundll32.exe	rundll32.exe
PID 1388 wrote to memory of 1536	1388	rundll32.exe	rundll32.exe
PID 1388 wrote to memory of 1536	1388	rundll32.exe	rundll32.exe
PID 1388 wrote to memory of 1536	1388	rundll32.exe	rundll32.exe
PID 1388 wrote to memory of 1536	1388	rundll32.exe	rundll32.exe
PID 1388 wrote to memory of 1536	1388	rundll32.exe	rundll32.exe
PID 1536 wrote to memory of 1528	1536	rundll32.exe	WerFault.exe
PID 1536 wrote to memory of 1528	1536	rundll32.exe	WerFault.exe
PID 1536 wrote to memory of 1528	1536	rundll32.exe	WerFault.exe
PID 1536 wrote to memory of 1528	1536	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\61b0b6148dfb82f659edc51f0326f1ffe6db91548dceab0c05add0c5d78ab894.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 324
3⤵
- Program crash
PID:1528

memory/1528-61-0x0000000000000000-mapping.dmp

Download
memory/1536-54-0x0000000000000000-mapping.dmp

Download
memory/1536-55-0x0000000075C31000-0x0000000075C33000-memory.dmp

Filesize
8KB

Download
memory/1536-57-0x0000000000960000-0x0000000000D38000-memory.dmp

Filesize
3.8MB

Download
memory/1536-58-0x0000000000960000-0x0000000000D38000-memory.dmp

Filesize
3.8MB

Download
memory/1536-59-0x0000000000960000-0x0000000000D38000-memory.dmp

Filesize
3.8MB

Download
memory/1536-56-0x0000000000960000-0x0000000000D38000-memory.dmp

Filesize
3.8MB

Download
memory/1536-60-0x0000000000960000-0x0000000000D38000-memory.dmp

Filesize
3.8MB

Download
memory/1536-62-0x0000000000960000-0x0000000000D38000-memory.dmp

Filesize
3.8MB

Download