a843115fdbb45cb85dbd8ddd64d5ecd74866791a419170fb79dbbc0fcc0a0be9

Analysis

max time kernel
27s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13-04-2023 22:07

Target

a843115fdbb45cb85dbd8ddd64d5ecd74866791a419170fb79dbbc0fcc0a0be9.dll
Size

4.5MB
MD5

a2ff2e3d19c664d80c9ee9708c6917ee
SHA1

c86bc28556ba028146f200ac8a4e6869f4df59cb
SHA256

a843115fdbb45cb85dbd8ddd64d5ecd74866791a419170fb79dbbc0fcc0a0be9
SHA512

2ceca8d3b95a0ec56b1868c78d73c1645769d63adfaf20226c6af5493aa1ab603bd567c78d29752075436975877a9010f8fac1b8bcac241a5c4ceef3925c758a
SSDEEP

98304:oIxMqYqGZn5IjBS8RAirE5VmWIkn+U0bUArvq25JjzIga:pMqYqO4Z5ECWhb0bUP25FM1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1972	1936	WerFault.exe	26

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 1936	2024	rundll32.exe	26
PID 2024 wrote to memory of 1936	2024	rundll32.exe	26
PID 2024 wrote to memory of 1936	2024	rundll32.exe	26
PID 2024 wrote to memory of 1936	2024	rundll32.exe	26
PID 2024 wrote to memory of 1936	2024	rundll32.exe	26
PID 2024 wrote to memory of 1936	2024	rundll32.exe	26
PID 2024 wrote to memory of 1936	2024	rundll32.exe	26
PID 1936 wrote to memory of 1972	1936	rundll32.exe	27
PID 1936 wrote to memory of 1972	1936	rundll32.exe	27
PID 1936 wrote to memory of 1972	1936	rundll32.exe	27
PID 1936 wrote to memory of 1972	1936	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a843115fdbb45cb85dbd8ddd64d5ecd74866791a419170fb79dbbc0fcc0a0be9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a843115fdbb45cb85dbd8ddd64d5ecd74866791a419170fb79dbbc0fcc0a0be9.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 292
    3⤵
    - Program crash
    PID:1972