00b300d880ee21431b3c9e72d3de0a79523fe9ea17ac83915b39e50443a57314

Analysis

max time kernel
141s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
16-04-2023 18:29

Target

api-ms-win-core-kernel32-legacy-l1-1-5.dll
Size

59KB
MD5

eb2e8581f041a5d56a5cd7bd4385088a
SHA1

6a0baec1e501be7925ce21b704a785a26f771586
SHA256

00b300d880ee21431b3c9e72d3de0a79523fe9ea17ac83915b39e50443a57314
SHA512

43e9461cc7735066260f7f0e33c44997cfecfa23efa3298acc6cdd6c886c3c07581d33029015c7d18f1ae7984ed6cc8c9180c350d2bd946f7cbf4dd0a6329f62
SSDEEP

96:IO4HFqklzsx2BiBVYbSLYbtKHNO+AZdY+Ey6AXQEthYCSZjZ31Fj99:IO4lqmpBcVRbE8ZFFj99

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1928	1996	WerFault.exe	26

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 1928	1996	rundll32.exe	27
PID 1996 wrote to memory of 1928	1996	rundll32.exe	27
PID 1996 wrote to memory of 1928	1996	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-core-kernel32-legacy-l1-1-5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1996 -s 84
  2⤵
  - Program crash
  PID:1928

memory/1996-54-0x000007FEFBB40000-0x000007FEFBB4E000-memory.dmp

Filesize
56KB

Download