e64bb75516fa8244fc31da6ee100cc10627f316aabc5ec9cfd2d9f5a028a6e4c

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
20-05-2023 21:14

Target

NL7Data0404.dll
Size

2.2MB
MD5

81b14fd1c9d2b830e55c93c4c38afa2f
SHA1

975bef050d9e8d2ee577e1b4db5dd6e2d67bff20
SHA256

878e2dbac4b6a6bcce54742f3c7bfd87aa93a6637cccc1e5d18ab65215d81bee
SHA512

16bcd415ca4cfc8813d990a304723a87122eede56a4f2c84b8fac91ccb0d5fd9c2db413358eecf145c1faad5b74f16b516a3c5e12f977bbca0cb6f66cc73d3ec
SSDEEP

24576:WckkkkkkHxKjbNX7UtOGwu1fg5tXVD539swzYNefx+Pff5pn3DXBdVjtxv/Ui:WeKYtOGwu1fg5FtJ9nMX5bL9z

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2004 1744 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2004	1744	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1744 wrote to memory of 2004	1744	rundll32.exe	WerFault.exe
PID 1744 wrote to memory of 2004	1744	rundll32.exe	WerFault.exe
PID 1744 wrote to memory of 2004	1744	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NL7Data0404.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1744

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1744 -s 116
2⤵
- Program crash
PID:2004