deab75d2e89891239e839490152f1149158b33cff13ee446928e7d3d67fc8ecb

Analysis

max time kernel
0s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
17/04/2023, 17:54

Target

NewVersionUnlimited/Desktop_Full/configs.dll
Size

471KB
MD5

ee220e800cb5af38e60f26b51999b105
SHA1

194c0891d7a9cec5fd8f4af5e9dd9ef28a967053
SHA256

08430abbc4eabd0615f42286038bac373f24ac8fe1117b2e304428bab7e143fd
SHA512

b776e9457f5ccf367aecf0816152602c5bfc206322d7e1134a2fd23673d51c4427a4b54fe35f4079c6470c06d2bfadd2b1ef5541dde7ea1f17be842d184978a8
SSDEEP

6144:/KK400WTwtX+fGPufBERUtk+Q4kiwoF0YG+L2Wf/xLu6:/5fiufqeBEHgGpY2Wf/dL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1500	936	WerFault.exe	26

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 936 wrote to memory of 1500	936	rundll32.exe	27
PID 936 wrote to memory of 1500	936	rundll32.exe	27
PID 936 wrote to memory of 1500	936	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NewVersionUnlimited\Desktop_Full\configs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:936
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 936 -s 84
  2⤵
  - Program crash
  PID:1500