5ac9880b75c0167eb9b9e0c4ecf1c5005dc5af13848e0a4497a3ac433a3fc8a0

Analysis

max time kernel
141s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
11-04-2023 19:24

Target

5ac9880b75c0167eb9b9e0c4ecf1c5005dc5af13848e0a4497a3ac433a3fc8a0.dll
Size

37KB
MD5

72fcd9b37d9a817972c5cba387a9750b
SHA1

20db5b59dc6b326585c08eae9dbef489f20f399c
SHA256

5ac9880b75c0167eb9b9e0c4ecf1c5005dc5af13848e0a4497a3ac433a3fc8a0
SHA512

2f07e5d4b2566776d431daead9e519dbe839055877995e812b21c1575bc343f2d7bb2405874aad541278969041925ccbb3a341f9b1fab8069c98d0a64fb88e1f
SSDEEP

768:SCy0qlJDmQj8qAQn3M78btMaHzBPf5PkpNsIVmlxARbL2:i0qlFmQAZQ3gyNHzBPf5PkpNaIL2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1696	1488	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 1488	1212	rundll32.exe	27
PID 1212 wrote to memory of 1488	1212	rundll32.exe	27
PID 1212 wrote to memory of 1488	1212	rundll32.exe	27
PID 1212 wrote to memory of 1488	1212	rundll32.exe	27
PID 1212 wrote to memory of 1488	1212	rundll32.exe	27
PID 1212 wrote to memory of 1488	1212	rundll32.exe	27
PID 1212 wrote to memory of 1488	1212	rundll32.exe	27
PID 1488 wrote to memory of 1696	1488	rundll32.exe	28
PID 1488 wrote to memory of 1696	1488	rundll32.exe	28
PID 1488 wrote to memory of 1696	1488	rundll32.exe	28
PID 1488 wrote to memory of 1696	1488	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ac9880b75c0167eb9b9e0c4ecf1c5005dc5af13848e0a4497a3ac433a3fc8a0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ac9880b75c0167eb9b9e0c4ecf1c5005dc5af13848e0a4497a3ac433a3fc8a0.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 204
    3⤵
    - Program crash
    PID:1696

memory/1488-54-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download