36c92e31b0f996b18ccb3fc6a8890d64cb8f159b689b4eb008cda58e2f96135a

Analysis

max time kernel
20s
max time network
35s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
23/04/2023, 05:31

Target

36c92e31b0f996b18ccb3fc6a8890d64cb8f159b689b4eb008cda58e2f96135a.dll
Size

4.0MB
MD5

c19c7b8f7145b562bdb6df34b7524bea
SHA1

88e1662ac19532dc92fe0ca04b7d4285cba74092
SHA256

36c92e31b0f996b18ccb3fc6a8890d64cb8f159b689b4eb008cda58e2f96135a
SHA512

3d6bef306143e4a97b926660748d0ce7dfb73ef9347c49f53f40eb1d7476fdec28291763629d937e899b277f1b4d7b0d1e2893106c54b4ab5e579002ab2ab77b
SSDEEP

98304:dFgNfLKHcpGsCh+vyU/PukYqBFpO9zaCP5hqzzP8ky+f9DuLGzY:opLDM9RUYqBfO9nP5GIky+f9qLT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1272	1308	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 1308	1312	rundll32.exe	28
PID 1312 wrote to memory of 1308	1312	rundll32.exe	28
PID 1312 wrote to memory of 1308	1312	rundll32.exe	28
PID 1312 wrote to memory of 1308	1312	rundll32.exe	28
PID 1312 wrote to memory of 1308	1312	rundll32.exe	28
PID 1312 wrote to memory of 1308	1312	rundll32.exe	28
PID 1312 wrote to memory of 1308	1312	rundll32.exe	28
PID 1308 wrote to memory of 1272	1308	rundll32.exe	29
PID 1308 wrote to memory of 1272	1308	rundll32.exe	29
PID 1308 wrote to memory of 1272	1308	rundll32.exe	29
PID 1308 wrote to memory of 1272	1308	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\36c92e31b0f996b18ccb3fc6a8890d64cb8f159b689b4eb008cda58e2f96135a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\36c92e31b0f996b18ccb3fc6a8890d64cb8f159b689b4eb008cda58e2f96135a.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 248
    3⤵
    - Program crash
    PID:1272

memory/1308-54-0x00000000739F0000-0x00000000741A7000-memory.dmp

Filesize
7.7MB

Download