8c18d4aedaeab8e7ab2c68947d6751d801f69bc54aab83fc0681b0063cfe5009

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
23/04/2023, 02:27

Target

8c18d4aedaeab8e7ab2c68947d6751d801f69bc54aab83fc0681b0063cfe5009.dll
Size

4.0MB
MD5

2ea58aec841899ecbb08efb0ab7c66d2
SHA1

5e11acf25f071b55ff8c92b1370a0661638988e4
SHA256

8c18d4aedaeab8e7ab2c68947d6751d801f69bc54aab83fc0681b0063cfe5009
SHA512

1a0ebde2384086595e6ac48a9d4ccfa87f212192cf66f074181ba946037f95d2895f3fbb837843518f42c48d0d9cfcb5cad192fb9217d3a407f191d2c833fb57
SSDEEP

98304:dFgNfLKHcpGsCh+vyU/PukYqBFpO9zaCP5hqzzP8ky+f9DuLGzK:opLDM9RUYqBfO9nP5GIky+f9qLB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1940	1964	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 1964	1988	rundll32.exe	28
PID 1988 wrote to memory of 1964	1988	rundll32.exe	28
PID 1988 wrote to memory of 1964	1988	rundll32.exe	28
PID 1988 wrote to memory of 1964	1988	rundll32.exe	28
PID 1988 wrote to memory of 1964	1988	rundll32.exe	28
PID 1988 wrote to memory of 1964	1988	rundll32.exe	28
PID 1988 wrote to memory of 1964	1988	rundll32.exe	28
PID 1964 wrote to memory of 1940	1964	rundll32.exe	29
PID 1964 wrote to memory of 1940	1964	rundll32.exe	29
PID 1964 wrote to memory of 1940	1964	rundll32.exe	29
PID 1964 wrote to memory of 1940	1964	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c18d4aedaeab8e7ab2c68947d6751d801f69bc54aab83fc0681b0063cfe5009.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c18d4aedaeab8e7ab2c68947d6751d801f69bc54aab83fc0681b0063cfe5009.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 248
    3⤵
    - Program crash
    PID:1940

memory/1964-54-0x0000000072B50000-0x0000000073307000-memory.dmp

Filesize
7.7MB

Download