a86e0c40a36d3f71a07511b363c7eea4e1fd4fbc570d8698bdf4a1ad992c92d9

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
23/04/2023, 04:58

Target

a86e0c40a36d3f71a07511b363c7eea4e1fd4fbc570d8698bdf4a1ad992c92d9.dll
Size

4.0MB
MD5

e6a084748bbc2717f3842fcef7385bdd
SHA1

85b2861ee5f4cc85b7a34eb7ad3a3418f5e12c51
SHA256

a86e0c40a36d3f71a07511b363c7eea4e1fd4fbc570d8698bdf4a1ad992c92d9
SHA512

f652caa41ba647746a5fa07edbb0cd71dde788956d8d1c1bcbc087926857c6c0f6231ad1381e0cc7438f3cf8842900bd763434f14e79bc4c55d3677352503ea0
SSDEEP

98304:dFgNfLKHcpGsCh+vyU/PukYqBFpO9zaCP5hqzzP8ky+f9DuLGz9:opLDM9RUYqBfO9nP5GIky+f9qLS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
796	1204	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 1204	1760	rundll32.exe	28
PID 1760 wrote to memory of 1204	1760	rundll32.exe	28
PID 1760 wrote to memory of 1204	1760	rundll32.exe	28
PID 1760 wrote to memory of 1204	1760	rundll32.exe	28
PID 1760 wrote to memory of 1204	1760	rundll32.exe	28
PID 1760 wrote to memory of 1204	1760	rundll32.exe	28
PID 1760 wrote to memory of 1204	1760	rundll32.exe	28
PID 1204 wrote to memory of 796	1204	rundll32.exe	29
PID 1204 wrote to memory of 796	1204	rundll32.exe	29
PID 1204 wrote to memory of 796	1204	rundll32.exe	29
PID 1204 wrote to memory of 796	1204	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a86e0c40a36d3f71a07511b363c7eea4e1fd4fbc570d8698bdf4a1ad992c92d9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a86e0c40a36d3f71a07511b363c7eea4e1fd4fbc570d8698bdf4a1ad992c92d9.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1204
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 248
    3⤵
    - Program crash
    PID:796

memory/1204-54-0x0000000073BF0000-0x00000000743A7000-memory.dmp

Filesize
7.7MB

Download