bdb0653f3d62ad5b95e94c013d44b64bd7d330f516976187d91e6801a2fc1fcf

Analysis

max time kernel
29s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
30-05-2023 00:59

Target

bdb0653f3d62ad5b95e94c013d44b64bd7d330f516976187d91e6801a2fc1fcf.dll
Size

215KB
MD5

0aa0da9e53b05099bc024a7b81be761f
SHA1

37f0cac29c625638824453d1986093e690b766b8
SHA256

bdb0653f3d62ad5b95e94c013d44b64bd7d330f516976187d91e6801a2fc1fcf
SHA512

88792aa1a34ced677bb8020bd6f85ba2208f1fbe9700479d53e36b0b6f190c0a8461f793626a16dec035762470e4ed42b038f534d64254fc4662290a962c6715
SSDEEP

6144:i/9lZWbcwKD6NjB1AO1TB68xeWNVjSS7n:a9lZgc+NB1XT48xeWNhSS7n

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2028	1676	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 1676	1236	rundll32.exe	28
PID 1236 wrote to memory of 1676	1236	rundll32.exe	28
PID 1236 wrote to memory of 1676	1236	rundll32.exe	28
PID 1236 wrote to memory of 1676	1236	rundll32.exe	28
PID 1236 wrote to memory of 1676	1236	rundll32.exe	28
PID 1236 wrote to memory of 1676	1236	rundll32.exe	28
PID 1236 wrote to memory of 1676	1236	rundll32.exe	28
PID 1676 wrote to memory of 2028	1676	rundll32.exe	29
PID 1676 wrote to memory of 2028	1676	rundll32.exe	29
PID 1676 wrote to memory of 2028	1676	rundll32.exe	29
PID 1676 wrote to memory of 2028	1676	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bdb0653f3d62ad5b95e94c013d44b64bd7d330f516976187d91e6801a2fc1fcf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bdb0653f3d62ad5b95e94c013d44b64bd7d330f516976187d91e6801a2fc1fcf.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 224
    3⤵
    - Program crash
    PID:2028