83ef2b168321c9f5987538dc82942ef91234f31f7bfa49604f95ba37a3241045

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
23/04/2023, 06:36

Target

83ef2b168321c9f5987538dc82942ef91234f31f7bfa49604f95ba37a3241045.dll
Size

4.0MB
MD5

06dc673ac0d027ba457c1a3f8168e3f2
SHA1

382eccb5b0559aad7ca7ddc4ad43ce36582ce1b0
SHA256

83ef2b168321c9f5987538dc82942ef91234f31f7bfa49604f95ba37a3241045
SHA512

9caf119fcedd02403d5ea8af38b569190d91b4f34fa6f42a891b05f105c30da6d78104c8f32a0e0d850352b84ab680297b18f6bac65356893a45fed9d871ecbb
SSDEEP

98304:dFgNfLKHcpGsCh+vyU/PukYqBFpO9zaCP5hqzzP8ky+f9DuLGzk:opLDM9RUYqBfO9nP5GIky+f9qLT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
332	1624	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 1624	1396	rundll32.exe	27
PID 1396 wrote to memory of 1624	1396	rundll32.exe	27
PID 1396 wrote to memory of 1624	1396	rundll32.exe	27
PID 1396 wrote to memory of 1624	1396	rundll32.exe	27
PID 1396 wrote to memory of 1624	1396	rundll32.exe	27
PID 1396 wrote to memory of 1624	1396	rundll32.exe	27
PID 1396 wrote to memory of 1624	1396	rundll32.exe	27
PID 1624 wrote to memory of 332	1624	rundll32.exe	28
PID 1624 wrote to memory of 332	1624	rundll32.exe	28
PID 1624 wrote to memory of 332	1624	rundll32.exe	28
PID 1624 wrote to memory of 332	1624	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\83ef2b168321c9f5987538dc82942ef91234f31f7bfa49604f95ba37a3241045.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\83ef2b168321c9f5987538dc82942ef91234f31f7bfa49604f95ba37a3241045.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 248
    3⤵
    - Program crash
    PID:332

memory/1624-54-0x00000000735B0000-0x0000000073D67000-memory.dmp

Filesize
7.7MB

Download