9f2944e822916b8a563c89828d0243d2598a8b17b20d152ff93eacde5b2ee7c1

Analysis

max time kernel
29s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22/04/2023, 23:23

Target

9f2944e822916b8a563c89828d0243d2598a8b17b20d152ff93eacde5b2ee7c1.dll
Size

4.0MB
MD5

0c1b70cab75fe8561e95e2a33ea76c4e
SHA1

3e902320ff44fd40c3c593f03175b0036e05ade8
SHA256

9f2944e822916b8a563c89828d0243d2598a8b17b20d152ff93eacde5b2ee7c1
SHA512

2cb5b2c5d85d8e425724ab3c3992248e5712c769b3ccafc1ee0e8803f2177f2c92a1393b0a259a0f82965d109a016d31a918eb13de9edb95d8e7326a39f284b2
SSDEEP

98304:dFgNfLKHcpGsCh+vyU/PukYqBFpO9zaCP5hqzzP8ky+f9DuLGz3:opLDM9RUYqBfO9nP5GIky+f9qLE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1712	1996	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 1996	1960	rundll32.exe	27
PID 1960 wrote to memory of 1996	1960	rundll32.exe	27
PID 1960 wrote to memory of 1996	1960	rundll32.exe	27
PID 1960 wrote to memory of 1996	1960	rundll32.exe	27
PID 1960 wrote to memory of 1996	1960	rundll32.exe	27
PID 1960 wrote to memory of 1996	1960	rundll32.exe	27
PID 1960 wrote to memory of 1996	1960	rundll32.exe	27
PID 1996 wrote to memory of 1712	1996	rundll32.exe	28
PID 1996 wrote to memory of 1712	1996	rundll32.exe	28
PID 1996 wrote to memory of 1712	1996	rundll32.exe	28
PID 1996 wrote to memory of 1712	1996	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f2944e822916b8a563c89828d0243d2598a8b17b20d152ff93eacde5b2ee7c1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f2944e822916b8a563c89828d0243d2598a8b17b20d152ff93eacde5b2ee7c1.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 248
    3⤵
    - Program crash
    PID:1712

memory/1996-54-0x00000000736C0000-0x0000000073E77000-memory.dmp

Filesize
7.7MB

Download