75313626730678ba9d5b90ce3c41acdecc24b5f8e3c659e891243dfe4d00dfad

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
23/04/2023, 06:30

Target

75313626730678ba9d5b90ce3c41acdecc24b5f8e3c659e891243dfe4d00dfad.dll
Size

4.0MB
MD5

b1d287fafd700fb1b50ee060e15ebe0d
SHA1

a1e56c9d7fc2282fac33e8e7a053f879254b0dc0
SHA256

75313626730678ba9d5b90ce3c41acdecc24b5f8e3c659e891243dfe4d00dfad
SHA512

e3d39a55cd9b18b392dd169843bd9f0b3d69615bbf697cc51f265b52e5a7a602d0916edd8fdbd05beaef960b903ed8e7cd20fc0ea0bed194a443a3a8891e48c1
SSDEEP

98304:dFgNfLKHcpGsCh+vyU/PukYqBFpO9zaCP5hqzzP8ky+f9DuLGzm:opLDM9RUYqBfO9nP5GIky+f9qLN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1628	1384	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 1384	1644	rundll32.exe	28
PID 1644 wrote to memory of 1384	1644	rundll32.exe	28
PID 1644 wrote to memory of 1384	1644	rundll32.exe	28
PID 1644 wrote to memory of 1384	1644	rundll32.exe	28
PID 1644 wrote to memory of 1384	1644	rundll32.exe	28
PID 1644 wrote to memory of 1384	1644	rundll32.exe	28
PID 1644 wrote to memory of 1384	1644	rundll32.exe	28
PID 1384 wrote to memory of 1628	1384	rundll32.exe	29
PID 1384 wrote to memory of 1628	1384	rundll32.exe	29
PID 1384 wrote to memory of 1628	1384	rundll32.exe	29
PID 1384 wrote to memory of 1628	1384	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\75313626730678ba9d5b90ce3c41acdecc24b5f8e3c659e891243dfe4d00dfad.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\75313626730678ba9d5b90ce3c41acdecc24b5f8e3c659e891243dfe4d00dfad.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1384
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 248
    3⤵
    - Program crash
    PID:1628

memory/1384-54-0x00000000744E0000-0x0000000074C97000-memory.dmp

Filesize
7.7MB

Download