cadf28b0906c549a8524d9aebcebb4d1e6b0c4c3054b01c672ea5bf300dcf0ef

Analysis

max time kernel
28s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22/04/2023, 23:46

Target

cadf28b0906c549a8524d9aebcebb4d1e6b0c4c3054b01c672ea5bf300dcf0ef.dll
Size

4.0MB
MD5

1261e4f3002dfc8ce879e08cd9470134
SHA1

ea4e090da2c0967abe9a8bbcf5fa8bbf3579a9e3
SHA256

cadf28b0906c549a8524d9aebcebb4d1e6b0c4c3054b01c672ea5bf300dcf0ef
SHA512

cdc825f90a09b83300930c81b1909b0f46fda4a15b938a0c8f9b651ecc0cce1b1cbf13fc6d9b6aba0bd6f7f922044eafedb3f3a74a0c4752714f71b8e2376da2
SSDEEP

98304:dFgNfLKHcpGsCh+vyU/PukYqBFpO9zaCP5hqzzP8ky+f9DuLGz6:opLDM9RUYqBfO9nP5GIky+f9qLl

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1956	2004	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2004	1992	rundll32.exe	28
PID 1992 wrote to memory of 2004	1992	rundll32.exe	28
PID 1992 wrote to memory of 2004	1992	rundll32.exe	28
PID 1992 wrote to memory of 2004	1992	rundll32.exe	28
PID 1992 wrote to memory of 2004	1992	rundll32.exe	28
PID 1992 wrote to memory of 2004	1992	rundll32.exe	28
PID 1992 wrote to memory of 2004	1992	rundll32.exe	28
PID 2004 wrote to memory of 1956	2004	rundll32.exe	29
PID 2004 wrote to memory of 1956	2004	rundll32.exe	29
PID 2004 wrote to memory of 1956	2004	rundll32.exe	29
PID 2004 wrote to memory of 1956	2004	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cadf28b0906c549a8524d9aebcebb4d1e6b0c4c3054b01c672ea5bf300dcf0ef.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cadf28b0906c549a8524d9aebcebb4d1e6b0c4c3054b01c672ea5bf300dcf0ef.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 248
    3⤵
    - Program crash
    PID:1956

memory/2004-54-0x00000000736F0000-0x0000000073EA7000-memory.dmp

Filesize
7.7MB

Download