8e713a3483546abbfc3891cc309f9faecb250df8d35314dd32c79223f3f5d70c

Analysis

max time kernel
188s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
16/04/2023, 18:29

Target

api-ms-win-core-namedpipe-l1-2-0.dll
Size

64KB
MD5

c96da505715fe0e4e3aa22877e216100
SHA1

617242e66cc86eadb8e8b15e43da40b1c13a490c
SHA256

8e713a3483546abbfc3891cc309f9faecb250df8d35314dd32c79223f3f5d70c
SHA512

4e6d816408afea1eb7ff895019832d91a1c660746a00ca034f41dc0112b8c4288317f35b8670bb6d361640443604e51060e174070272982aeee0ca53ae28c07d
SSDEEP

96:IdoSP6LJfzsDoBmznVYbSLYbYHYnUCJdpOP/88h/9l66NoYeuYOBtjpdRkQHPcMJ:IdoSPgJ9BQVVsi39FDXpRNKZFIj99

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1988	1724	WerFault.exe	20

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1988	1724	rundll32.exe	28
PID 1724 wrote to memory of 1988	1724	rundll32.exe	28
PID 1724 wrote to memory of 1988	1724	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-core-namedpipe-l1-2-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1724 -s 84
  2⤵
  - Program crash
  PID:1988

memory/1724-54-0x000007FEFBC80000-0x000007FEFBC8F000-memory.dmp

Filesize
60KB

Download