25e2b25a77c09da623a453989fbff3577af67c15ec0a2878acc2de7bf83fab32

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
10/06/2023, 19:34

Target

25e2b25a77c09da623a453989fbff3577af67c15ec0a2878acc2de7bf83fab32.dll
Size

264KB
MD5

6d4d0c75249acfbe8dc8b342bc678224
SHA1

504adb4b02a68c850b6ed1d5694def6014ad8d63
SHA256

25e2b25a77c09da623a453989fbff3577af67c15ec0a2878acc2de7bf83fab32
SHA512

bf398a4ae5c4517421706ef2bf74a46872fb009808e801576d048d55cd14a225a4f3f6fe29644f559d1379efe24f92f7f947e9ad11f203e166aa4ba8f1b0927d
SSDEEP

6144:u1cBNnIOW9NSrxsiJle38U53FN3sUZm071:umRIO2NS/ep3FN3sCm071

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1184	600	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 600	1520	rundll32.exe	27
PID 1520 wrote to memory of 600	1520	rundll32.exe	27
PID 1520 wrote to memory of 600	1520	rundll32.exe	27
PID 1520 wrote to memory of 600	1520	rundll32.exe	27
PID 1520 wrote to memory of 600	1520	rundll32.exe	27
PID 1520 wrote to memory of 600	1520	rundll32.exe	27
PID 1520 wrote to memory of 600	1520	rundll32.exe	27
PID 600 wrote to memory of 1184	600	rundll32.exe	28
PID 600 wrote to memory of 1184	600	rundll32.exe	28
PID 600 wrote to memory of 1184	600	rundll32.exe	28
PID 600 wrote to memory of 1184	600	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\25e2b25a77c09da623a453989fbff3577af67c15ec0a2878acc2de7bf83fab32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\25e2b25a77c09da623a453989fbff3577af67c15ec0a2878acc2de7bf83fab32.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 600 -s 260
    3⤵
    - Program crash
    PID:1184

memory/600-54-0x0000000010000000-0x000000001004B000-memory.dmp

Filesize
300KB

Download