03ec0e12586149944a5c4f30474afcf47349bc7b635b4da8f9d406c35c05249f

Analysis

max time kernel
142s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
16/04/2023, 18:28

Target

api-ms-win-appmodel-runtime-l1-1-0.dll
Size

64KB
MD5

322d35a3cb3876605c22b8029953f951
SHA1

4c146287ac5a04bdb25a4c51b3101d2108a7ad83
SHA256

03ec0e12586149944a5c4f30474afcf47349bc7b635b4da8f9d406c35c05249f
SHA512

b674d4b45dc8bf72580f99291262961b06babafbaf8a28813996fc6b8d0ff416b611d4c5dd72a7e995d608a989b4e1ad6e763ed61599f571ac11954e90647508
SSDEEP

96:Ioo5aWGOPaWu+WfTkWTEpHZZzsIkkBqXnVYbSLYbYHYnUCn5yGtyfAwDrsW4Y5Y9:IooSOPN+zEBpBIVVsW+gX5u2SYZFIj99

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1992	1980	WerFault.exe	21

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1992	1980	rundll32.exe	27
PID 1980 wrote to memory of 1992	1980	rundll32.exe	27
PID 1980 wrote to memory of 1992	1980	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1980 -s 84
  2⤵
  - Program crash
  PID:1992

memory/1980-54-0x000007FEFB020000-0x000007FEFB02F000-memory.dmp

Filesize
60KB

Download