ea60d03a35ef2c50306dbbd1ad408c714b1548035c615359af5a7ce8c0bd14a8

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
24-03-2023 17:18

Target

api-ms-win-core-interlocked-l1-1-0.dll
Size

20KB
MD5

5f2e21c4f0be6a9e15c8ddc2ecdd7089
SHA1

1282b65a9b7276679366fe88c55fab442c0cc3a1
SHA256

ea60d03a35ef2c50306dbbd1ad408c714b1548035c615359af5a7ce8c0bd14a8
SHA512

a32c5ed72d4bfda60b2259e5982e42a79040225a4877246f3a645e05bfb8be395555fa22b2f0ed884f5fd82a8021bba85637727544c9adbb3a8c97b80e7a30f2
SSDEEP

192:lBwGRWBhWVWYnO/VWQ4eWcfWPfQLCamylqnajP3TxLyH:TwGRWBhWFUfmQ3Jllz3VL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1772	1328	WerFault.exe	19

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 1772	1328	rundll32.exe	28
PID 1328 wrote to memory of 1772	1328	rundll32.exe	28
PID 1328 wrote to memory of 1772	1328	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-core-interlocked-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1328 -s 84
  2⤵
  - Program crash
  PID:1772