74001e9572641e53deebf6359e7ef90f3fd85f768c02a01200eeeaf08ead2a44

Analysis

max time kernel
7s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
05-05-2023 18:48

Target

a42LfkJ6QAc8s9R.dll
Size

332KB
MD5

c8c2b0c625aadd480f246fd9cbde0dea
SHA1

b45046e5728f82ba549b6a637c30b969066a8c68
SHA256

74001e9572641e53deebf6359e7ef90f3fd85f768c02a01200eeeaf08ead2a44
SHA512

d092988399b32117a2c521dd0de0c26724568f2032a19f6c7820ecde624f2559b70866ea6905eb54c9597f85f94f463d39c3ddddbf4e6cd72699d3afd28bb80b
SSDEEP

6144:HGttsygB2RWc0sVk5k6A4s9FGMReiD4DmEk5cci4j5zLgSdsg:mttsygB2RWc0sV6k6AbDGSPzqciwpPd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1240	1072	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1072	2044	rundll32.exe	28
PID 2044 wrote to memory of 1072	2044	rundll32.exe	28
PID 2044 wrote to memory of 1072	2044	rundll32.exe	28
PID 2044 wrote to memory of 1072	2044	rundll32.exe	28
PID 2044 wrote to memory of 1072	2044	rundll32.exe	28
PID 2044 wrote to memory of 1072	2044	rundll32.exe	28
PID 2044 wrote to memory of 1072	2044	rundll32.exe	28
PID 1072 wrote to memory of 1240	1072	rundll32.exe	29
PID 1072 wrote to memory of 1240	1072	rundll32.exe	29
PID 1072 wrote to memory of 1240	1072	rundll32.exe	29
PID 1072 wrote to memory of 1240	1072	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a42LfkJ6QAc8s9R.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a42LfkJ6QAc8s9R.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 224
    3⤵
    - Program crash
    PID:1240