b7c3127d35289d2d62d1571ef5360da564fe72aa742b182cef269143ef3d0d3e

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22/04/2023, 23:31

Target

b7c3127d35289d2d62d1571ef5360da564fe72aa742b182cef269143ef3d0d3e.dll
Size

4.0MB
MD5

709d9b1b1274219f2ee340dd1e6453bf
SHA1

a85cbc39c1ae43a3927c45d8a108efaed0b3c0e2
SHA256

b7c3127d35289d2d62d1571ef5360da564fe72aa742b182cef269143ef3d0d3e
SHA512

f90a3f59544145f007dc018f4313e96327d2c3ec748c8dc1534a03463aa6c3c4c42912609afba3a519e6a14326dbe0d499117547df8a33b51506fc4c43e53bbf
SSDEEP

98304:dFgNfLKHcpGsCh+vyU/PukYqBFpO9zaCP5hqzzP8ky+f9DuLGzT:opLDM9RUYqBfO9nP5GIky+f9qLg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
832	1136	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 1136	1200	rundll32.exe	28
PID 1200 wrote to memory of 1136	1200	rundll32.exe	28
PID 1200 wrote to memory of 1136	1200	rundll32.exe	28
PID 1200 wrote to memory of 1136	1200	rundll32.exe	28
PID 1200 wrote to memory of 1136	1200	rundll32.exe	28
PID 1200 wrote to memory of 1136	1200	rundll32.exe	28
PID 1200 wrote to memory of 1136	1200	rundll32.exe	28
PID 1136 wrote to memory of 832	1136	rundll32.exe	29
PID 1136 wrote to memory of 832	1136	rundll32.exe	29
PID 1136 wrote to memory of 832	1136	rundll32.exe	29
PID 1136 wrote to memory of 832	1136	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b7c3127d35289d2d62d1571ef5360da564fe72aa742b182cef269143ef3d0d3e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b7c3127d35289d2d62d1571ef5360da564fe72aa742b182cef269143ef3d0d3e.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1136
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1136 -s 248
    3⤵
    - Program crash
    PID:832

memory/1136-54-0x0000000073A40000-0x00000000741F7000-memory.dmp

Filesize
7.7MB

Download