34e64b1038e0528ab8208a5a03dab4501d942850b0f31ca878e101e9218f6095

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
30-05-2023 09:53

Target

HTCTL32.dll
Size

320KB
MD5

c94005d2dcd2a54e40510344e0bb9435
SHA1

55b4a1620c5d0113811242c20bd9870a1e31d542
SHA256

3c072532bf7674d0c5154d4d22a9d9c0173530c0d00f69911cdbc2552175d899
SHA512

2e6f673864a54b1dcad9532ef9b18a9c45c0844f1f53e699fade2f41e43fa5cbc9b8e45e6f37b95f84cf6935a96fba2950ee3e0e9542809fd288fefba34ddd6a
SSDEEP

6144:Hib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OKB:Hib5YbsXioEgULFpSzya9/lY5SilQCfR

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

688 1932 WerFault.exe rundll32.exe

pid	pid_target	process	target process
688	1932	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1936 wrote to memory of 1932	1936	rundll32.exe	rundll32.exe
PID 1936 wrote to memory of 1932	1936	rundll32.exe	rundll32.exe
PID 1936 wrote to memory of 1932	1936	rundll32.exe	rundll32.exe
PID 1936 wrote to memory of 1932	1936	rundll32.exe	rundll32.exe
PID 1936 wrote to memory of 1932	1936	rundll32.exe	rundll32.exe
PID 1936 wrote to memory of 1932	1936	rundll32.exe	rundll32.exe
PID 1936 wrote to memory of 1932	1936	rundll32.exe	rundll32.exe
PID 1932 wrote to memory of 688	1932	rundll32.exe	WerFault.exe
PID 1932 wrote to memory of 688	1932	rundll32.exe	WerFault.exe
PID 1932 wrote to memory of 688	1932	rundll32.exe	WerFault.exe
PID 1932 wrote to memory of 688	1932	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HTCTL32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1936

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HTCTL32.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 232
3⤵
- Program crash
PID:688