20fd24c9ac1ed19bf2dc37f7de0d2cd9327b4c6dfce1dcba302acaa53d9c136f

Analysis

max time kernel
140s
max time network
35s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
31-03-2023 04:51

Target

20fd24c9ac1ed19bf2dc37f7de0d2cd9327b4c6dfce1dcba302acaa53d9c136f.dll
Size

406KB
MD5

f2ec4d3ecc14b503d8b7d0bbeff709da
SHA1

63695a83d5ec89a9f1bed135d8db8e4b9f1cfe23
SHA256

20fd24c9ac1ed19bf2dc37f7de0d2cd9327b4c6dfce1dcba302acaa53d9c136f
SHA512

f497841b6ab15cb2645de9a771580ca6ded2edc35d692cee608ff39f15d464012616fa6caf3e302c09797d3a8325ed7ef00a52470b578af2b72d3ff6d758787c
SSDEEP

6144:gg86sZbdQ9SFGv78Ck5WAmOohb35RuFFxDH319FO5QCHmMg78l4C998UZ7OYDcOy:EbDFGv+RohbpM/xDH319FcaC9dDcO

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1088 2000 WerFault.exe rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

2000 rundll32.exe

pid	pid_target	process	target process
1088	2000	WerFault.exe	rundll32.exe

pid	process
2000	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1712 wrote to memory of 2000	1712	rundll32.exe	rundll32.exe
PID 1712 wrote to memory of 2000	1712	rundll32.exe	rundll32.exe
PID 1712 wrote to memory of 2000	1712	rundll32.exe	rundll32.exe
PID 1712 wrote to memory of 2000	1712	rundll32.exe	rundll32.exe
PID 1712 wrote to memory of 2000	1712	rundll32.exe	rundll32.exe
PID 1712 wrote to memory of 2000	1712	rundll32.exe	rundll32.exe
PID 1712 wrote to memory of 2000	1712	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 1088	2000	rundll32.exe	WerFault.exe
PID 2000 wrote to memory of 1088	2000	rundll32.exe	WerFault.exe
PID 2000 wrote to memory of 1088	2000	rundll32.exe	WerFault.exe
PID 2000 wrote to memory of 1088	2000	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\20fd24c9ac1ed19bf2dc37f7de0d2cd9327b4c6dfce1dcba302acaa53d9c136f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 272
3⤵
- Program crash
PID:1088

memory/2000-55-0x0000000010000000-0x00000000100FF000-memory.dmp

Filesize
1020KB

Download
memory/2000-56-0x0000000010000000-0x00000000100FF000-memory.dmp

Filesize
1020KB

Download
memory/2000-54-0x0000000010000000-0x00000000100FF000-memory.dmp

Filesize
1020KB

Download
memory/2000-57-0x0000000010000000-0x00000000100FF000-memory.dmp

Filesize
1020KB

Download