99f85b6ed0ef6aabfa64727992c2d6dc3564dc49ebdb4a11a9647aeb32067544

Analysis

max time kernel
15s
max time network
35s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
24/05/2023, 18:47

Target

mainlibr.dll
Size

2.5MB
MD5

deb5ebc2a3a6f776cfed0afb7b350a9b
SHA1

28615bc9fa2077b3597415a76a55f7775e0c8007
SHA256

8c81c84548ce191b11390ebaa71397d23662593b1c113aaa0392e40ff0f9307a
SHA512

5765c54147c8b950c594619d03b3a154e94aa43ce39ca91831b39229049794e6f6ee8226ebe4367c27b1d40409d6f9feaad2f8fa1a9d42a777b9df88fb6e5711
SSDEEP

49152:Ld0krhjbVYU9U/ElyrLKlvGBO58GBjG9nYM6JBe4PjnhMsQHNClhIdYTf2O+yX37:ykrRyylvGB65YNCMghMtHIledkp+R

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1140	1336	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 1336	1420	rundll32.exe	28
PID 1420 wrote to memory of 1336	1420	rundll32.exe	28
PID 1420 wrote to memory of 1336	1420	rundll32.exe	28
PID 1420 wrote to memory of 1336	1420	rundll32.exe	28
PID 1420 wrote to memory of 1336	1420	rundll32.exe	28
PID 1420 wrote to memory of 1336	1420	rundll32.exe	28
PID 1420 wrote to memory of 1336	1420	rundll32.exe	28
PID 1336 wrote to memory of 1140	1336	rundll32.exe	29
PID 1336 wrote to memory of 1140	1336	rundll32.exe	29
PID 1336 wrote to memory of 1140	1336	rundll32.exe	29
PID 1336 wrote to memory of 1140	1336	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mainlibr.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\mainlibr.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1336
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 228
    3⤵
    - Program crash
    PID:1140