399746c8256c7f4b7aa2406d7c0bb94be06c4a0ceac21df5157367d700b9019b

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22/04/2023, 23:43

Target

399746c8256c7f4b7aa2406d7c0bb94be06c4a0ceac21df5157367d700b9019b.dll
Size

4.0MB
MD5

8c37332430aa8f3694d07a269ab99523
SHA1

4b62fe061326d9102f51126441cad7bc3d067a13
SHA256

399746c8256c7f4b7aa2406d7c0bb94be06c4a0ceac21df5157367d700b9019b
SHA512

50f4cb69f85937bcff0cd4ddc665e2c2e0c297e899f03bf58db6b4ba78b89ded2533152e583f344afdcac25fbac0e2e4e013b9d6175b08b1378a11ebd61b6114
SSDEEP

98304:dFgNfLKHcpGsCh+vyU/PukYqBFpO9zaCP5hqzzP8ky+f9DuLGzS:opLDM9RUYqBfO9nP5GIky+f9qLh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1420	1652	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 1652	1932	rundll32.exe	28
PID 1932 wrote to memory of 1652	1932	rundll32.exe	28
PID 1932 wrote to memory of 1652	1932	rundll32.exe	28
PID 1932 wrote to memory of 1652	1932	rundll32.exe	28
PID 1932 wrote to memory of 1652	1932	rundll32.exe	28
PID 1932 wrote to memory of 1652	1932	rundll32.exe	28
PID 1932 wrote to memory of 1652	1932	rundll32.exe	28
PID 1652 wrote to memory of 1420	1652	rundll32.exe	29
PID 1652 wrote to memory of 1420	1652	rundll32.exe	29
PID 1652 wrote to memory of 1420	1652	rundll32.exe	29
PID 1652 wrote to memory of 1420	1652	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\399746c8256c7f4b7aa2406d7c0bb94be06c4a0ceac21df5157367d700b9019b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\399746c8256c7f4b7aa2406d7c0bb94be06c4a0ceac21df5157367d700b9019b.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1652
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 248
    3⤵
    - Program crash
    PID:1420

memory/1652-54-0x0000000073720000-0x0000000073ED7000-memory.dmp

Filesize
7.7MB

Download