628b7be2f1bb39f173458d0595ddfed907157ef25a574d34faaa4bfd80129071

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
28/02/2023, 11:20

Target
StrangulatorySubduedness.dll
Size 348KB
Sample230228-nfn8aaba97
SHA256 628b7be2f1bb39f173458d0595ddfed907157ef25a574d34faaa4bfd80129071
MD5 842ff3818aab3bc168f997aa43163434
SHA1 ba69ce91bcc57883ed2989749a9c05c2ef8bd899
SHA512 57c7ce4fd461e0b6d8599f68cd9dedf382f5cec1c70cb599a90964fa1a8d2c07e6397587bb69b65662de2bc45e582acbe723e0909282fb2a7bf4ec5243434282
SSDEEP 6144:znCkEzy3WOKrHe7EPvIbQP952w7QNlC20wHa8zbC6+fYyf9unVes12qxWCla8aGN:NEyrw2s20wHao+mmeWCl9Vdsd
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1912	1916	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 1916	908	rundll32.exe	27
PID 908 wrote to memory of 1916	908	rundll32.exe	27
PID 908 wrote to memory of 1916	908	rundll32.exe	27
PID 908 wrote to memory of 1916	908	rundll32.exe	27
PID 908 wrote to memory of 1916	908	rundll32.exe	27
PID 908 wrote to memory of 1916	908	rundll32.exe	27
PID 908 wrote to memory of 1916	908	rundll32.exe	27
PID 1916 wrote to memory of 1912	1916	rundll32.exe	28
PID 1916 wrote to memory of 1912	1916	rundll32.exe	28
PID 1916 wrote to memory of 1912	1916	rundll32.exe	28
PID 1916 wrote to memory of 1912	1916	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\StrangulatorySubduedness.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\StrangulatorySubduedness.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 224
    3⤵
    - Program crash
    PID:1912