63bae6ef7079dc92968fe00d5adebd6488ac116f56364d776f86464fcdf08ea3

Analysis

max time kernel
15s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
24/04/2023, 20:06

Target
NewVersionUnlimited/Desktop_Full/modules.dll
Size 907KB
Sample230424-yvhn6aec75
SHA256 37ec5f998a5c376d4fcd4342b43a4163d1f043e0f7711e46677cd30013882723
MD5 dc05f0b8f1a32e872721d3486e6332b8
SHA1 dbf055b0f934640fadcfaa93971fead8df7a3869
SHA512 0f89d713237ef11a1ef8d824ad9767bb13fb4f5f334acdd65af0ba6e54cec4a910398636683254b3fe4d46a069a1781187313684ff827a907b8b968134f6efa0
SSDEEP 24576:z0OY4ZFajHYDTR2yfVbf+c6Z5WODYsHh6g3P0zAk75:z0CZFaj4HR2yfVbd6Z5WODYsHh6g3P03
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2036	1736	WerFault.exe	26

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2036	1736	rundll32.exe	27
PID 1736 wrote to memory of 2036	1736	rundll32.exe	27
PID 1736 wrote to memory of 2036	1736	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NewVersionUnlimited\Desktop_Full\modules.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1736 -s 92
  2⤵
  - Program crash
  PID:2036