b7c3127d35289d2d62d1571ef5360da564fe72aa742b182cef269143ef3d0d3e

Analysis

max time kernel
83s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
22-04-2023 23:31

Target

b7c3127d35289d2d62d1571ef5360da564fe72aa742b182cef269143ef3d0d3e.dll
Size

4.0MB
MD5

709d9b1b1274219f2ee340dd1e6453bf
SHA1

a85cbc39c1ae43a3927c45d8a108efaed0b3c0e2
SHA256

b7c3127d35289d2d62d1571ef5360da564fe72aa742b182cef269143ef3d0d3e
SHA512

f90a3f59544145f007dc018f4313e96327d2c3ec748c8dc1534a03463aa6c3c4c42912609afba3a519e6a14326dbe0d499117547df8a33b51506fc4c43e53bbf
SSDEEP

98304:dFgNfLKHcpGsCh+vyU/PukYqBFpO9zaCP5hqzzP8ky+f9DuLGzT:opLDM9RUYqBfO9nP5GIky+f9qLg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1248	3908	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 3908	2116	rundll32.exe	85
PID 2116 wrote to memory of 3908	2116	rundll32.exe	85
PID 2116 wrote to memory of 3908	2116	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b7c3127d35289d2d62d1571ef5360da564fe72aa742b182cef269143ef3d0d3e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b7c3127d35289d2d62d1571ef5360da564fe72aa742b182cef269143ef3d0d3e.dll,#1
  2⤵
  PID:3908
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 628
    3⤵
    - Program crash
    PID:1248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3908 -ip 3908
1⤵
PID:760

memory/3908-133-0x0000000074620000-0x0000000074DD7000-memory.dmp

Filesize
7.7MB

Download