a506be227f6496c641b4ea6a62d06c52db23ecc23e58666d015ff94684b78755

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
26-02-2023 20:23

Target

a506be227f6496c641b4ea6a62d06c52db23ecc23e58666d015ff94684b78755.dll
Size

936KB
MD5

9ed496deb4ada6abc07fddcb3722c303
SHA1

0df5f6aab79751db8b3f2b911a1b04242a077833
SHA256

a506be227f6496c641b4ea6a62d06c52db23ecc23e58666d015ff94684b78755
SHA512

57151e2b9b0133c018f7d7bee028572760a0690bc05718f04b84d8c4b03f2323c8c08d0a49cbdbde6cb51288cc4fefb1956c1acdf02246c8b0394430248a2d1b
SSDEEP

12288:SXhuPC7HTXV2WNubjEwc9lSAA8Kthn0DjrDoLd+yILn:EhuPC7zl9AbjcTS18whnSHELd+ymn

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1512 1404 WerFault.exe rundll32.exe
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

rundll32.exe

pid process

1404 rundll32.exe
1404 rundll32.exe
1404 rundll32.exe
1404 rundll32.exe
1404 rundll32.exe

pid	pid_target	process	target process
1512	1404	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1984 wrote to memory of 1404	1984	rundll32.exe	rundll32.exe
PID 1984 wrote to memory of 1404	1984	rundll32.exe	rundll32.exe
PID 1984 wrote to memory of 1404	1984	rundll32.exe	rundll32.exe
PID 1984 wrote to memory of 1404	1984	rundll32.exe	rundll32.exe
PID 1984 wrote to memory of 1404	1984	rundll32.exe	rundll32.exe
PID 1984 wrote to memory of 1404	1984	rundll32.exe	rundll32.exe
PID 1984 wrote to memory of 1404	1984	rundll32.exe	rundll32.exe
PID 1404 wrote to memory of 1512	1404	rundll32.exe	WerFault.exe
PID 1404 wrote to memory of 1512	1404	rundll32.exe	WerFault.exe
PID 1404 wrote to memory of 1512	1404	rundll32.exe	WerFault.exe
PID 1404 wrote to memory of 1512	1404	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a506be227f6496c641b4ea6a62d06c52db23ecc23e58666d015ff94684b78755.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 240
3⤵
- Program crash
PID:1512

memory/1404-54-0x0000000001D80000-0x0000000001E68000-memory.dmp

Filesize
928KB

Download
memory/1404-55-0x00000000022D0000-0x00000000023B8000-memory.dmp

Filesize
928KB

Download
memory/1404-56-0x00000000025B0000-0x0000000002698000-memory.dmp

Filesize
928KB

Download
memory/1404-57-0x0000000002890000-0x0000000002978000-memory.dmp

Filesize
928KB

Download
memory/1404-58-0x0000000002B30000-0x0000000002C18000-memory.dmp

Filesize
928KB

Download