59aa8b7f80826036536acd61965d663bffdab2cbbf6abda6b12bde349d90b7a6

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
23/04/2023, 00:38

Target

59aa8b7f80826036536acd61965d663bffdab2cbbf6abda6b12bde349d90b7a6.dll
Size

4.0MB
MD5

2fce9f4ab7c3608c6a6df2af165a6c51
SHA1

ffd66193966562e276ba67a8fc3904224030c962
SHA256

59aa8b7f80826036536acd61965d663bffdab2cbbf6abda6b12bde349d90b7a6
SHA512

8a2815950d703ab3b0f0ccb5c6162099bd23fc3fe89ca04f48a609eaf7e314c14f3a9c6eebd2ab2d900e6f03ebebd705787d3d198581f56561b50b7af2098b5a
SSDEEP

98304:dFgNfLKHcpGsCh+vyU/PukYqBFpO9zaCP5hqzzP8ky+f9DuLGzJ:opLDM9RUYqBfO9nP5GIky+f9qLy

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1052	1368	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 1368	1156	rundll32.exe	28
PID 1156 wrote to memory of 1368	1156	rundll32.exe	28
PID 1156 wrote to memory of 1368	1156	rundll32.exe	28
PID 1156 wrote to memory of 1368	1156	rundll32.exe	28
PID 1156 wrote to memory of 1368	1156	rundll32.exe	28
PID 1156 wrote to memory of 1368	1156	rundll32.exe	28
PID 1156 wrote to memory of 1368	1156	rundll32.exe	28
PID 1368 wrote to memory of 1052	1368	rundll32.exe	29
PID 1368 wrote to memory of 1052	1368	rundll32.exe	29
PID 1368 wrote to memory of 1052	1368	rundll32.exe	29
PID 1368 wrote to memory of 1052	1368	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\59aa8b7f80826036536acd61965d663bffdab2cbbf6abda6b12bde349d90b7a6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\59aa8b7f80826036536acd61965d663bffdab2cbbf6abda6b12bde349d90b7a6.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1368
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 248
    3⤵
    - Program crash
    PID:1052

memory/1368-54-0x0000000073440000-0x0000000073BF7000-memory.dmp

Filesize
7.7MB

Download