1b3f39e0d2c736b7dbbc037931820f690698b2d4caa903abd49a8104375f0def

Analysis

max time kernel
45s
max time network
36s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
01-04-2023 07:40

Target

1/data/dxsupport.dll
Size

310KB
MD5

0b9fcfbd6d44e4d83605cc35171668c8
SHA1

f4013116d6750829851370ed19a9eaf8251ad6e1
SHA256

ebdcedbc3e24b911aacd7bb666ab426397ca7d7883a8d4e3cf28946041c95425
SHA512

e920e284f47f888d10cac45ec8775e58481f5a8c2316d3fa01ff1e7b1bb63c64d2d0850b2da8fd040727b969d3b3f9b85afbd86b6cbfaecca580b853a1499f59
SSDEEP

3072:Jy6nSomUPQukwpSor62AIiGYIR2LGPHc0Ul+S4KQdw6tqYKVFlCh7NZqSEgbh:JciFkwpL2DI0yPHTw6tVKYr

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1504 1576 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1504	1576	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1576 wrote to memory of 1504	1576	rundll32.exe	WerFault.exe
PID 1576 wrote to memory of 1504	1576	rundll32.exe	WerFault.exe
PID 1576 wrote to memory of 1504	1576	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1\data\dxsupport.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1576 -s 160
  2⤵
  - Program crash
  PID:1504