68e8b9770ddf6925a9668b1d31f5b59bfa0b940dad1327b557b900009bac9868

Analysis

max time kernel
28s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22-04-2023 22:58

Target

68e8b9770ddf6925a9668b1d31f5b59bfa0b940dad1327b557b900009bac9868.dll
Size

4.0MB
MD5

4c40bb4b29b9b094d9e4450a8cbbc19a
SHA1

bc89aa90bada05a7e86881fbcb0fa6c4f08976c8
SHA256

68e8b9770ddf6925a9668b1d31f5b59bfa0b940dad1327b557b900009bac9868
SHA512

71888444719868d017d3043e83bc1a4d424cb099e00b0b9a5c3ad0bdec2369bf447e41401e94519e2f9d7880f6d2319f026177fffa54ea4b58348c418a1de6de
SSDEEP

98304:dFgNfLKHcpGsCh+vyU/PukYqBFpO9zaCP5hqzzP8ky+f9DuLGzi:opLDM9RUYqBfO9nP5GIky+f9qLR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1504	1600	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 1600	1604	rundll32.exe	28
PID 1604 wrote to memory of 1600	1604	rundll32.exe	28
PID 1604 wrote to memory of 1600	1604	rundll32.exe	28
PID 1604 wrote to memory of 1600	1604	rundll32.exe	28
PID 1604 wrote to memory of 1600	1604	rundll32.exe	28
PID 1604 wrote to memory of 1600	1604	rundll32.exe	28
PID 1604 wrote to memory of 1600	1604	rundll32.exe	28
PID 1600 wrote to memory of 1504	1600	rundll32.exe	29
PID 1600 wrote to memory of 1504	1600	rundll32.exe	29
PID 1600 wrote to memory of 1504	1600	rundll32.exe	29
PID 1600 wrote to memory of 1504	1600	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\68e8b9770ddf6925a9668b1d31f5b59bfa0b940dad1327b557b900009bac9868.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\68e8b9770ddf6925a9668b1d31f5b59bfa0b940dad1327b557b900009bac9868.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 248
    3⤵
    - Program crash
    PID:1504

memory/1600-54-0x00000000739D0000-0x0000000074187000-memory.dmp

Filesize
7.7MB

Download