3639fa09708f7b00d58ce24cdc6994e980d283e5da068898b7674aa99182d89b

Analysis

max time kernel
19s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
26/05/2023, 18:34

Target

PresentationNative_cor3.dll
Size

1.2MB
MD5

101536b90a55412fbbe8b5247ecd7af4
SHA1

8697af6fb8f07339db7cd45fea206bfef8b32563
SHA256

aea2d02150ca2c68d8323486daaa198a5237c1e47141dc3c907e2c4f46126304
SHA512

7cc262ad78a697025242bbf5af94c647fb01ee4b00099352fdf7eb9f0bdeb4d30ef9cf9d9f13cc73ba88eec0c2eb9fc8cbaf27c30e604ff6b6b668bdc55cc6d0
SSDEEP

24576:URBe8yLZba2oWlrbIwL0lMqfPUbsQf8N81hlAc0htf/H+WggUR8xm+OC8d:Ui8yLo2oWlHqfPBQfCIlAcU/H+ZR8x7I

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
948	1596	WerFault.exe	25

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 948	1596	rundll32.exe	26
PID 1596 wrote to memory of 948	1596	rundll32.exe	26
PID 1596 wrote to memory of 948	1596	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PresentationNative_cor3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1596 -s 116
  2⤵
  - Program crash
  PID:948