f4cde6c7377a48a27d986e02a7662ee1f5f8b874f4c9a21828b83fa8df915c48

Analysis

max time kernel
30s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
23-04-2023 03:45

Target

f4cde6c7377a48a27d986e02a7662ee1f5f8b874f4c9a21828b83fa8df915c48.dll
Size

4.0MB
MD5

ed7fb46aed9e4dc25817401b52302048
SHA1

672445d0faf748e10adc1e2d1b8ff7e61be0005c
SHA256

f4cde6c7377a48a27d986e02a7662ee1f5f8b874f4c9a21828b83fa8df915c48
SHA512

3e17700623dcf21dac5f54daf56008f85a44b0a5ba7f10d15084fb6406809af57d407deea897b35e89bb5710995734390d6236d08bd7a738e760bbe8832913bd
SSDEEP

98304:dFgNfLKHcpGsCh+vyU/PukYqBFpO9zaCP5hqzzP8ky+f9DuLGzn:opLDM9RUYqBfO9nP5GIky+f9qLw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
924	1336	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 1336	1260	rundll32.exe	28
PID 1260 wrote to memory of 1336	1260	rundll32.exe	28
PID 1260 wrote to memory of 1336	1260	rundll32.exe	28
PID 1260 wrote to memory of 1336	1260	rundll32.exe	28
PID 1260 wrote to memory of 1336	1260	rundll32.exe	28
PID 1260 wrote to memory of 1336	1260	rundll32.exe	28
PID 1260 wrote to memory of 1336	1260	rundll32.exe	28
PID 1336 wrote to memory of 924	1336	rundll32.exe	29
PID 1336 wrote to memory of 924	1336	rundll32.exe	29
PID 1336 wrote to memory of 924	1336	rundll32.exe	29
PID 1336 wrote to memory of 924	1336	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4cde6c7377a48a27d986e02a7662ee1f5f8b874f4c9a21828b83fa8df915c48.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4cde6c7377a48a27d986e02a7662ee1f5f8b874f4c9a21828b83fa8df915c48.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1336
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 248
    3⤵
    - Program crash
    PID:924

memory/1336-54-0x0000000073840000-0x0000000073FF7000-memory.dmp

Filesize
7.7MB

Download