b5496071a575311863ec52e2eee66bf05b49c13d8d0ccf83f9fa0ea28654d675

Analysis

max time kernel
150s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
07/03/2023, 20:44

Target

f595c83297ca404eef1f62aade30c4a1c96cf6bdf12d5221130f362b84472b81.dll
Size

434KB
MD5

a6251c747b3f34868ff21db41209d4a6
SHA1

d8cf975125fe9df61436821dcb4003780fc89730
SHA256

f595c83297ca404eef1f62aade30c4a1c96cf6bdf12d5221130f362b84472b81
SHA512

29a20ff744550a5047171fd9f1030e2a21c0f3d97cca64761d6fc942159c8c88e901e0c24ab00c5a02fa905100ad8f2f5a15d6578e85b507f28add006353304c
SSDEEP

12288:rJZ701RXT1BaB4Irm8VGf9hyI8K9HGgHA:VZ701RXT1wB4Irz0f9hNb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2008	912	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 912	1400	rundll32.exe	27
PID 1400 wrote to memory of 912	1400	rundll32.exe	27
PID 1400 wrote to memory of 912	1400	rundll32.exe	27
PID 1400 wrote to memory of 912	1400	rundll32.exe	27
PID 1400 wrote to memory of 912	1400	rundll32.exe	27
PID 1400 wrote to memory of 912	1400	rundll32.exe	27
PID 1400 wrote to memory of 912	1400	rundll32.exe	27
PID 912 wrote to memory of 2008	912	rundll32.exe	28
PID 912 wrote to memory of 2008	912	rundll32.exe	28
PID 912 wrote to memory of 2008	912	rundll32.exe	28
PID 912 wrote to memory of 2008	912	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f595c83297ca404eef1f62aade30c4a1c96cf6bdf12d5221130f362b84472b81.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f595c83297ca404eef1f62aade30c4a1c96cf6bdf12d5221130f362b84472b81.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 912 -s 224
    3⤵
    - Program crash
    PID:2008

memory/912-54-0x000000006B200000-0x000000006B271000-memory.dmp

Filesize
452KB

Download