deab75d2e89891239e839490152f1149158b33cff13ee446928e7d3d67fc8ecb

Analysis

max time kernel
24s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
17/04/2023, 17:54

Target

NewVersionUnlimited/Desktop_Full/modules.dll
Size

907KB
MD5

dc05f0b8f1a32e872721d3486e6332b8
SHA1

dbf055b0f934640fadcfaa93971fead8df7a3869
SHA256

37ec5f998a5c376d4fcd4342b43a4163d1f043e0f7711e46677cd30013882723
SHA512

0f89d713237ef11a1ef8d824ad9767bb13fb4f5f334acdd65af0ba6e54cec4a910398636683254b3fe4d46a069a1781187313684ff827a907b8b968134f6efa0
SSDEEP

24576:z0OY4ZFajHYDTR2yfVbf+c6Z5WODYsHh6g3P0zAk75:z0CZFaj4HR2yfVbd6Z5WODYsHh6g3P03

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1940	1980	WerFault.exe	20

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1940	1980	rundll32.exe	28
PID 1980 wrote to memory of 1940	1980	rundll32.exe	28
PID 1980 wrote to memory of 1940	1980	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NewVersionUnlimited\Desktop_Full\modules.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1980 -s 92
  2⤵
  - Program crash
  PID:1940