c291b1c955dca442f70ae591a8f1fd771223247ab8b5589048d3b3d19da7a7c6

Analysis

max time kernel
19s
max time network
35s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
10/03/2023, 18:27

Target

Adobe Flash CS3/AdobePSL.dll
Size

11.7MB
MD5

6c13ff35d92d9dd051bd8088d550126d
SHA1

9762d12b4d81da98e7d08a72f7fb3eb0a5cc8169
SHA256

0e8dcc574a85497034fcaa325dacf66b3750625d1d7ab1631190344bff1071bf
SHA512

1f4259d049e10048dc9629b85970bd65135a4c1e76c98351d4b15670e778778af802a17b2690372b2c8d8aee1d64eead80f0776d37125783876d91bb2488a459
SSDEEP

196608:OCK2ei9xUDlnP9kg/1Y5XfHteK5XxFDNOCP:OC2i9xUJdqFPMK5XxB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1768	872	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 872	1220	rundll32.exe	27
PID 1220 wrote to memory of 872	1220	rundll32.exe	27
PID 1220 wrote to memory of 872	1220	rundll32.exe	27
PID 1220 wrote to memory of 872	1220	rundll32.exe	27
PID 1220 wrote to memory of 872	1220	rundll32.exe	27
PID 1220 wrote to memory of 872	1220	rundll32.exe	27
PID 1220 wrote to memory of 872	1220	rundll32.exe	27
PID 872 wrote to memory of 1768	872	rundll32.exe	28
PID 872 wrote to memory of 1768	872	rundll32.exe	28
PID 872 wrote to memory of 1768	872	rundll32.exe	28
PID 872 wrote to memory of 1768	872	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Adobe Flash CS3\AdobePSL.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Adobe Flash CS3\AdobePSL.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 872 -s 260
    3⤵
    - Program crash
    PID:1768