5fa59081c28b1a74728f1d983fcd6dcfe92020acd8c3ce9109d97f594b06524f

Analysis

max time kernel
141s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
30-05-2023 05:21

Target

5fa59081c28b1a74728f1d983fcd6dcfe92020acd8c3ce9109d97f594b06524f.dll
Size

232KB
MD5

fc7b5a14d80700587745afeed385c31e
SHA1

2db40bda7bbf9ba3155769214638e59f525632ca
SHA256

5fa59081c28b1a74728f1d983fcd6dcfe92020acd8c3ce9109d97f594b06524f
SHA512

6b203c74fa5506dbd96754f1df8455eb35141c478becabaec5a10ce483809e652e7509d0791aedba53b4070973035d6cb620dc07d84bf3b43c1a7f2d67ea2c7d
SSDEEP

6144:bS8yCpFdygeZVswjM4nQM9HrW8BA9zS8bk4Q:28yS4VsH4n9HrWiH8o

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2040 2036 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2040	2036	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1704 wrote to memory of 2036	1704	rundll32.exe	rundll32.exe
PID 1704 wrote to memory of 2036	1704	rundll32.exe	rundll32.exe
PID 1704 wrote to memory of 2036	1704	rundll32.exe	rundll32.exe
PID 1704 wrote to memory of 2036	1704	rundll32.exe	rundll32.exe
PID 1704 wrote to memory of 2036	1704	rundll32.exe	rundll32.exe
PID 1704 wrote to memory of 2036	1704	rundll32.exe	rundll32.exe
PID 1704 wrote to memory of 2036	1704	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 2040	2036	rundll32.exe	WerFault.exe
PID 2036 wrote to memory of 2040	2036	rundll32.exe	WerFault.exe
PID 2036 wrote to memory of 2040	2036	rundll32.exe	WerFault.exe
PID 2036 wrote to memory of 2040	2036	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5fa59081c28b1a74728f1d983fcd6dcfe92020acd8c3ce9109d97f594b06524f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5fa59081c28b1a74728f1d983fcd6dcfe92020acd8c3ce9109d97f594b06524f.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 276
    3⤵
    - Program crash
    PID:2040

memory/2036-55-0x0000000000740000-0x00000000007CA000-memory.dmp

Filesize
552KB

Download
memory/2036-54-0x0000000000740000-0x00000000007CA000-memory.dmp

Filesize
552KB

Download
memory/2036-56-0x0000000000740000-0x00000000007CA000-memory.dmp

Filesize
552KB

Download