39f0f6cf53d387571129c1929d60ec1ac0c23df9009bea732e1390942e11cbd0

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
01/06/2023, 20:12

Target

39f0f6cf53d387571129c1929d60ec1ac0c23df9009bea732e1390942e11cbd0.dll
Size

264KB
MD5

677b6fe882bcaffbf98ee855c08df562
SHA1

544415884903adcb9a30f2fad1503e07e97c540e
SHA256

39f0f6cf53d387571129c1929d60ec1ac0c23df9009bea732e1390942e11cbd0
SHA512

113cdb775a027635377f353cc216728ac3f7e02629c501cc848921cf7cfeca5527abed4f589622f189a32ecf9c499ef9d4cef9cae1047898e5a50103abbc045f
SSDEEP

6144:19vLYOAETidRoESEVPLHCeEiIUrjQatsU0HPEctzjIsX:19v35TgDFDsxHPEctzj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1124	1268	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 1268	1764	rundll32.exe	28
PID 1764 wrote to memory of 1268	1764	rundll32.exe	28
PID 1764 wrote to memory of 1268	1764	rundll32.exe	28
PID 1764 wrote to memory of 1268	1764	rundll32.exe	28
PID 1764 wrote to memory of 1268	1764	rundll32.exe	28
PID 1764 wrote to memory of 1268	1764	rundll32.exe	28
PID 1764 wrote to memory of 1268	1764	rundll32.exe	28
PID 1268 wrote to memory of 1124	1268	rundll32.exe	29
PID 1268 wrote to memory of 1124	1268	rundll32.exe	29
PID 1268 wrote to memory of 1124	1268	rundll32.exe	29
PID 1268 wrote to memory of 1124	1268	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\39f0f6cf53d387571129c1929d60ec1ac0c23df9009bea732e1390942e11cbd0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\39f0f6cf53d387571129c1929d60ec1ac0c23df9009bea732e1390942e11cbd0.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1268
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 260
    3⤵
    - Program crash
    PID:1124

memory/1268-54-0x0000000010000000-0x000000001004B000-memory.dmp

Filesize
300KB

Download