0918405ab0ab2485937af6329e7e1a6992afd98489ccb21cfe77c761328b272f

Analysis

max time kernel
141s
max time network
33s
platform
windows7_x64
resource
win7-20230220-es
resource tags

arch:x64arch:x86image:win7-20230220-eslocale:es-esos:windows7-x64systemwindows
submitted
28/05/2023, 02:33

Target

unrar.dll
Size

154KB
MD5

35aac587c0fe1e407ff60f2b3361be59
SHA1

1e6ce5ecdb8da137766ccd3b8ffe435ec7a6b714
SHA256

2a308fbd4ff115349b968b2386140ba09d5f3cb35f82a2f8b96d4c50d03b2d3f
SHA512

30be5ecc9a3cfdd8b500958f0d831641292eb6255b46578952faccee93d245fd8db77a40fe356c8cf3c82589ed72979ac520620562e98f530e9a155978a68668
SSDEEP

3072:aK+06LCZpzws6HLXtusCMbWhXS+fN9HFrvpBV8eh1yBDUG2klq0eBeR2M0zBr:JPjZpz7ALXtBbeS+fDHNEUG2k3eoR2MM

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1952	756	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 756	1296	rundll32.exe	28
PID 1296 wrote to memory of 756	1296	rundll32.exe	28
PID 1296 wrote to memory of 756	1296	rundll32.exe	28
PID 1296 wrote to memory of 756	1296	rundll32.exe	28
PID 1296 wrote to memory of 756	1296	rundll32.exe	28
PID 1296 wrote to memory of 756	1296	rundll32.exe	28
PID 1296 wrote to memory of 756	1296	rundll32.exe	28
PID 756 wrote to memory of 1952	756	rundll32.exe	29
PID 756 wrote to memory of 1952	756	rundll32.exe	29
PID 756 wrote to memory of 1952	756	rundll32.exe	29
PID 756 wrote to memory of 1952	756	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\unrar.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\unrar.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:756
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 228
    3⤵
    - Program crash
    PID:1952

memory/756-54-0x00000000001D0000-0x0000000000201000-memory.dmp

Filesize
196KB

Download
memory/756-55-0x00000000001D0000-0x0000000000201000-memory.dmp

Filesize
196KB

Download