d7608b8f684e7465599a4673fefa329de646e38d934dd79e592288c68720bcfa

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14/04/2023, 07:04

Target

d7608b8f684e7465599a4673fefa329de646e38d934dd79e592288c68720bcfa.dll
Size

556KB
MD5

c9ab1cd04e796fd7f084a1dd2d40cc2d
SHA1

f05b2066a375a5c8d3dfc44d6097f577cd4f0255
SHA256

d7608b8f684e7465599a4673fefa329de646e38d934dd79e592288c68720bcfa
SHA512

ad974a30ac9e5915cb221db1c07fbaaa2d7b7f9a820841c62e887347abec76e8b626d97cfca6fb386a74f2f4bc89a4c484e46cc585770cd215e357eca0b13d9c
SSDEEP

12288:0sqXe4DNX3lWA38yEDJQTiaQS8LztCYKH5t3XjMjDW:vqXeSNX3lWA3DEeCLcYKbIj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2028	2012	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2012	1728	rundll32.exe	27
PID 1728 wrote to memory of 2012	1728	rundll32.exe	27
PID 1728 wrote to memory of 2012	1728	rundll32.exe	27
PID 1728 wrote to memory of 2012	1728	rundll32.exe	27
PID 1728 wrote to memory of 2012	1728	rundll32.exe	27
PID 1728 wrote to memory of 2012	1728	rundll32.exe	27
PID 1728 wrote to memory of 2012	1728	rundll32.exe	27
PID 2012 wrote to memory of 2028	2012	rundll32.exe	28
PID 2012 wrote to memory of 2028	2012	rundll32.exe	28
PID 2012 wrote to memory of 2028	2012	rundll32.exe	28
PID 2012 wrote to memory of 2028	2012	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d7608b8f684e7465599a4673fefa329de646e38d934dd79e592288c68720bcfa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d7608b8f684e7465599a4673fefa329de646e38d934dd79e592288c68720bcfa.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 224
    3⤵
    - Program crash
    PID:2028