c5f1dfbf8d4b1d8d5c43f668292056d5b670fea174e6e79d3cc2ba341d66a21f

Analysis

max time kernel
15s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
18-02-2023 03:32

Target

data/dddd.dll
Size

200.2MB
MD5

a56e5617a52635cc50c810fe6785b68f
SHA1

d451cd22d4fd46b63565adb6e75f47d76502cbd5
SHA256

dc50d80a97cd772dd0d5067df6b2f12e5ef4598ed36d4837b6ca7c9f96dd6860
SHA512

9a627ec9e4c505e2cf16b82c82ef07f50c94a0ff7e5b89e5fc5f84091acccdbd75f0d2ccbfd172b24afca1c12185a92515f0fa6963431e5dd1401765938f3ac2
SSDEEP

1572864:BpGZU4Cwmanvo7P18LJrbZuxXG5xr+R2gTmdjLcgoV0Bpmqgi7omdr71FPeHl8o1:gMGIWPWpgwWyHEH1hY

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\debug.log	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1408	1748	WerFault.exe	17

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 1408	1748	rundll32.exe	28
PID 1748 wrote to memory of 1408	1748	rundll32.exe	28
PID 1748 wrote to memory of 1408	1748	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\data\dddd.dll,#1
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1748 -s 244
  2⤵
  - Program crash
  PID:1408