c98101b47ca30554f9fa784ecdf3c6cab12cf8265e561608dea5d0e633b1b4f2

Analysis

max time kernel
26s
max time network
29s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
23-04-2023 03:08

Target

c98101b47ca30554f9fa784ecdf3c6cab12cf8265e561608dea5d0e633b1b4f2.dll
Size

4.0MB
MD5

e3e6ddcb3aedf6a116107060e77d2d8d
SHA1

841fb5e9a7b3dcd8021c97cbb544a821277aec47
SHA256

c98101b47ca30554f9fa784ecdf3c6cab12cf8265e561608dea5d0e633b1b4f2
SHA512

a3f08b80ade6db10361776f882ec44bc8e934244c1f7410824192425ed12829c19059bcd49e08e2976e14ec4c51c49d7b21bbf809d9618d294a84ab068c70f12
SSDEEP

98304:dFgNfLKHcpGsCh+vyU/PukYqBFpO9zaCP5hqzzP8ky+f9DuLGzp:opLDM9RUYqBfO9nP5GIky+f9qLS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
868	948	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 948	1336	rundll32.exe	27
PID 1336 wrote to memory of 948	1336	rundll32.exe	27
PID 1336 wrote to memory of 948	1336	rundll32.exe	27
PID 1336 wrote to memory of 948	1336	rundll32.exe	27
PID 1336 wrote to memory of 948	1336	rundll32.exe	27
PID 1336 wrote to memory of 948	1336	rundll32.exe	27
PID 1336 wrote to memory of 948	1336	rundll32.exe	27
PID 948 wrote to memory of 868	948	rundll32.exe	28
PID 948 wrote to memory of 868	948	rundll32.exe	28
PID 948 wrote to memory of 868	948	rundll32.exe	28
PID 948 wrote to memory of 868	948	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c98101b47ca30554f9fa784ecdf3c6cab12cf8265e561608dea5d0e633b1b4f2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c98101b47ca30554f9fa784ecdf3c6cab12cf8265e561608dea5d0e633b1b4f2.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:948
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 948 -s 248
    3⤵
    - Program crash
    PID:868

memory/948-54-0x00000000732F0000-0x0000000073AA7000-memory.dmp

Filesize
7.7MB

Download