64ca399326af32754984382b4bf86b63587518ba95cc543f84e70ec0354abca5

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22/04/2023, 22:20

Target

64ca399326af32754984382b4bf86b63587518ba95cc543f84e70ec0354abca5.dll
Size

4.0MB
MD5

e7f875a8ac2a192b94294617d1d3dfcd
SHA1

c3641bfc9aaaa0c93257b2c2d489a45e89ee931a
SHA256

64ca399326af32754984382b4bf86b63587518ba95cc543f84e70ec0354abca5
SHA512

5372aba71e81249417dbcf7b694aca4225371dad85fb6b7f5af4bb48ddf4f6e528feb5fc34f88a2bbdfae19fa37b8ae2aaa6989e45a6055021410f937f3b6f9b
SSDEEP

98304:dFgNfLKHcpGsCh+vyU/PukYqBFpO9zaCP5hqzzP8ky+f9DuLGzq:opLDM9RUYqBfO9nP5GIky+f9qLh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1344	2012	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2012	1708	rundll32.exe	28
PID 1708 wrote to memory of 2012	1708	rundll32.exe	28
PID 1708 wrote to memory of 2012	1708	rundll32.exe	28
PID 1708 wrote to memory of 2012	1708	rundll32.exe	28
PID 1708 wrote to memory of 2012	1708	rundll32.exe	28
PID 1708 wrote to memory of 2012	1708	rundll32.exe	28
PID 1708 wrote to memory of 2012	1708	rundll32.exe	28
PID 2012 wrote to memory of 1344	2012	rundll32.exe	29
PID 2012 wrote to memory of 1344	2012	rundll32.exe	29
PID 2012 wrote to memory of 1344	2012	rundll32.exe	29
PID 2012 wrote to memory of 1344	2012	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\64ca399326af32754984382b4bf86b63587518ba95cc543f84e70ec0354abca5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\64ca399326af32754984382b4bf86b63587518ba95cc543f84e70ec0354abca5.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 248
    3⤵
    - Program crash
    PID:1344

memory/2012-54-0x0000000072DF0000-0x00000000735A7000-memory.dmp

Filesize
7.7MB

Download