4ff2bb8260dfe8307fee8282e5c8e23182741857eef72ca00f7b351bd7b7c3d1

Analysis

max time kernel
18s
max time network
48s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
11/05/2023, 18:35

Target

4ff2bb8260dfe8307fee8282e5c8e23182741857eef72ca00f7b351bd7b7c3d1.dll
Size

4.3MB
MD5

2702c56793599778a697307b09668e78
SHA1

2ce249174a9e8f85aa85f0ff4bbbb89f3966d691
SHA256

4ff2bb8260dfe8307fee8282e5c8e23182741857eef72ca00f7b351bd7b7c3d1
SHA512

44d77c96fb2e209210a1e3857e96009818cb5b7872de96de92ca4faf7343e351d9822b746fbf0c9533b7d453a081966695f148240e3e9d0c516f710c385fa320
SSDEEP

98304:W765InN0+CQKstRTh4GnbIsvsJq9mor1:JgbNKsigvsJY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
976	1964	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 1964	1756	rundll32.exe	28
PID 1756 wrote to memory of 1964	1756	rundll32.exe	28
PID 1756 wrote to memory of 1964	1756	rundll32.exe	28
PID 1756 wrote to memory of 1964	1756	rundll32.exe	28
PID 1756 wrote to memory of 1964	1756	rundll32.exe	28
PID 1756 wrote to memory of 1964	1756	rundll32.exe	28
PID 1756 wrote to memory of 1964	1756	rundll32.exe	28
PID 1964 wrote to memory of 976	1964	rundll32.exe	29
PID 1964 wrote to memory of 976	1964	rundll32.exe	29
PID 1964 wrote to memory of 976	1964	rundll32.exe	29
PID 1964 wrote to memory of 976	1964	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff2bb8260dfe8307fee8282e5c8e23182741857eef72ca00f7b351bd7b7c3d1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff2bb8260dfe8307fee8282e5c8e23182741857eef72ca00f7b351bd7b7c3d1.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 376
    3⤵
    - Program crash
    PID:976