e7901ae133af75e7e23ee9ef5e6af4dc87f7fbc90c9079a57e0146b519ea063e

Analysis

max time kernel
141s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
07/03/2023, 20:40

Target

16859077ca8ac1b4b0b16b5df76fe391672dae77244aa1f9282dcb87643d909f.dll
Size

434KB
MD5

20efd81f294e0ef2bc3c9e8c4059a052
SHA1

b02cd6861d945fa5cdeaa4bf07c6c7fbc8d4d134
SHA256

16859077ca8ac1b4b0b16b5df76fe391672dae77244aa1f9282dcb87643d909f
SHA512

ed3403343bdc80c82b2e92fad591616bd94ab45660b1f187216109b15c170a213f739fee01574f9e5f495d4dac8b8026e28996f578633f01574b7adbcc80340b
SSDEEP

12288:rJZ701RXT1BaB4Irm8VGf9hyI8K9HGg+A:VZ701RXT1wB4Irz0f9hNq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2004	1740	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 988 wrote to memory of 1740	988	rundll32.exe	28
PID 988 wrote to memory of 1740	988	rundll32.exe	28
PID 988 wrote to memory of 1740	988	rundll32.exe	28
PID 988 wrote to memory of 1740	988	rundll32.exe	28
PID 988 wrote to memory of 1740	988	rundll32.exe	28
PID 988 wrote to memory of 1740	988	rundll32.exe	28
PID 988 wrote to memory of 1740	988	rundll32.exe	28
PID 1740 wrote to memory of 2004	1740	rundll32.exe	29
PID 1740 wrote to memory of 2004	1740	rundll32.exe	29
PID 1740 wrote to memory of 2004	1740	rundll32.exe	29
PID 1740 wrote to memory of 2004	1740	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\16859077ca8ac1b4b0b16b5df76fe391672dae77244aa1f9282dcb87643d909f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\16859077ca8ac1b4b0b16b5df76fe391672dae77244aa1f9282dcb87643d909f.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 224
    3⤵
    - Program crash
    PID:2004

memory/1740-54-0x000000006B200000-0x000000006B271000-memory.dmp

Filesize
452KB

Download