c23d418ff605240a76a03158e3595f1e09b66ac8817df2b41329f4b94ccebc16

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
20-02-2023 10:12

Target

c23d418ff605240a76a03158e3595f1e09b66ac8817df2b41329f4b94ccebc16.dll
Size

393KB
MD5

9210fc8d094ae70c58cfdce6a57720de
SHA1

4eff590916f5956451cbe053bed955936747c1d5
SHA256

c23d418ff605240a76a03158e3595f1e09b66ac8817df2b41329f4b94ccebc16
SHA512

b32f91c3f1f4328316b8c523f08a04f61eebef5b96438580a1caa68c702832897a0792d40d38294eb443d16c64da1ec94c42f07cba4d0587e3ca925c88f9cb47
SSDEEP

12288:xXh6mhXRHGVtRaGwimcXO916kfyJGDkFgXl9htXa:xX4eHcRaGwiw6kgGcgXlDtq

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1720 1520 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1720	1520	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 792 wrote to memory of 1520	792	rundll32.exe	rundll32.exe
PID 792 wrote to memory of 1520	792	rundll32.exe	rundll32.exe
PID 792 wrote to memory of 1520	792	rundll32.exe	rundll32.exe
PID 792 wrote to memory of 1520	792	rundll32.exe	rundll32.exe
PID 792 wrote to memory of 1520	792	rundll32.exe	rundll32.exe
PID 792 wrote to memory of 1520	792	rundll32.exe	rundll32.exe
PID 792 wrote to memory of 1520	792	rundll32.exe	rundll32.exe
PID 1520 wrote to memory of 1720	1520	rundll32.exe	WerFault.exe
PID 1520 wrote to memory of 1720	1520	rundll32.exe	WerFault.exe
PID 1520 wrote to memory of 1720	1520	rundll32.exe	WerFault.exe
PID 1520 wrote to memory of 1720	1520	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c23d418ff605240a76a03158e3595f1e09b66ac8817df2b41329f4b94ccebc16.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:792

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c23d418ff605240a76a03158e3595f1e09b66ac8817df2b41329f4b94ccebc16.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 264
3⤵
- Program crash
PID:1720

memory/1520-54-0x0000000000000000-mapping.dmp

Download
memory/1520-55-0x00000000763D1000-0x00000000763D3000-memory.dmp

Filesize
8KB

Download
memory/1520-57-0x00000000007F0000-0x00000000008E1000-memory.dmp

Filesize
964KB

Download
memory/1520-56-0x00000000007F0000-0x00000000008E1000-memory.dmp

Filesize
964KB

Download
memory/1520-58-0x00000000007F0000-0x00000000008E1000-memory.dmp

Filesize
964KB

Download
memory/1520-60-0x00000000007F0000-0x00000000008E1000-memory.dmp

Filesize
964KB

Download
memory/1720-59-0x0000000000000000-mapping.dmp

Download