c5f1dfbf8d4b1d8d5c43f668292056d5b670fea174e6e79d3cc2ba341d66a21f

Analysis

max time kernel
25s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
18-02-2023 03:32

Target

data/vdlxipp61_x64.dll
Size

13.7MB
MD5

bde9c30a4b6748aed8c94c5c939927ab
SHA1

1d286f53792b96f896732725700dcea94ab6b9f1
SHA256

dfbc4b7bfbf97ebdf5f63e5dc7ae34382f6415c8aca006c5a2bf22e22709235b
SHA512

e2effdeec594607f9f428229280c654c38a765d4b527a37958d50cad7ca07c7983342c93ed99b557d67e31adad8863b1c14b60dda1d50c764f0215da722b3684
SSDEEP

98304:I9kiiddf7OpZEWXic+DyJiouuCjiE9iGpcekz3BxFhg4BwPGeRJbRyqPBEnl86Ph:I9kiRYmw3Z7ej5edq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1284	2028	WerFault.exe	11

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1284	2028	rundll32.exe	28
PID 2028 wrote to memory of 1284	2028	rundll32.exe	28
PID 2028 wrote to memory of 1284	2028	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\data\vdlxipp61_x64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2028 -s 84
  2⤵
  - Program crash
  PID:1284