14617d12ce085b1175f11951e124c0263a953f4b1428d3da9bf6eacb56fefac5

Analysis

max time kernel
28s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
29-05-2023 10:28

Target

14617d12ce085b1175f11951e124c0263a953f4b1428d3da9bf6eacb56fefac5.dll
Size

880KB
MD5

1c247ce014926506ce53091db58f6feb
SHA1

3a83cf44edfb4f9cc3406665a64621591badfb77
SHA256

14617d12ce085b1175f11951e124c0263a953f4b1428d3da9bf6eacb56fefac5
SHA512

d0fcc67f781995116e05a5abe25ff2f0a6a8a59ea1b6fb07cc78d2c93b12ad55bafab843f390576ca3654d27911a566186f368208a6713c9fb5b4be866f18a33
SSDEEP

12288:IUtvrhB2PHPO9sUO6F3kxho/bLtyArVHBUdVb:IURrhwPysZ6VshIbU8OLb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1988	2008	WerFault.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2008	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2008	1996	rundll32.exe	28
PID 1996 wrote to memory of 2008	1996	rundll32.exe	28
PID 1996 wrote to memory of 2008	1996	rundll32.exe	28
PID 1996 wrote to memory of 2008	1996	rundll32.exe	28
PID 1996 wrote to memory of 2008	1996	rundll32.exe	28
PID 1996 wrote to memory of 2008	1996	rundll32.exe	28
PID 1996 wrote to memory of 2008	1996	rundll32.exe	28
PID 2008 wrote to memory of 1988	2008	rundll32.exe	29
PID 2008 wrote to memory of 1988	2008	rundll32.exe	29
PID 2008 wrote to memory of 1988	2008	rundll32.exe	29
PID 2008 wrote to memory of 1988	2008	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\14617d12ce085b1175f11951e124c0263a953f4b1428d3da9bf6eacb56fefac5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\14617d12ce085b1175f11951e124c0263a953f4b1428d3da9bf6eacb56fefac5.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 272
    3⤵
    - Program crash
    PID:1988