902c009ff0c32f99683334c52014844bbfeb37aefd2e0733aaac1d9add7d6a3f

Analysis

max time kernel
140s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
20/04/2023, 01:16

Target

902c009ff0c32f99683334c52014844bbfeb37aefd2e0733aaac1d9add7d6a3f.dll
Size

161KB
MD5

86c3f17d734f9370a229fc0294f406c9
SHA1

9a4ceae42b0ad31f12bff1c6c67167f65b6a37ce
SHA256

902c009ff0c32f99683334c52014844bbfeb37aefd2e0733aaac1d9add7d6a3f
SHA512

38f8aaf961cc71af4919b9851af2f610753daa2267221de03acb5b15e089f779c3bd91dd701fe90dda94345d1f6c8e7c05f4b71460bb3baae05c157060e5dfc4
SSDEEP

3072:AT64VoI67r1d8eLlvJ9YTBj1BQEauAbV+tEn5J/NRsgCX/X/amtT:AT6tdd8klfYVXQwAbln52lXn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1984	2020	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2020	2008	rundll32.exe	27
PID 2008 wrote to memory of 2020	2008	rundll32.exe	27
PID 2008 wrote to memory of 2020	2008	rundll32.exe	27
PID 2008 wrote to memory of 2020	2008	rundll32.exe	27
PID 2008 wrote to memory of 2020	2008	rundll32.exe	27
PID 2008 wrote to memory of 2020	2008	rundll32.exe	27
PID 2008 wrote to memory of 2020	2008	rundll32.exe	27
PID 2020 wrote to memory of 1984	2020	rundll32.exe	28
PID 2020 wrote to memory of 1984	2020	rundll32.exe	28
PID 2020 wrote to memory of 1984	2020	rundll32.exe	28
PID 2020 wrote to memory of 1984	2020	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\902c009ff0c32f99683334c52014844bbfeb37aefd2e0733aaac1d9add7d6a3f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\902c009ff0c32f99683334c52014844bbfeb37aefd2e0733aaac1d9add7d6a3f.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 332
    3⤵
    - Program crash
    PID:1984

memory/2020-54-0x0000000010000000-0x0000000010060000-memory.dmp

Filesize
384KB

Download
memory/2020-55-0x0000000000160000-0x0000000000162000-memory.dmp

Filesize
8KB

Download