488d0f5201d8316ac97a68af9842542cbce31c67ac58395e4a5c0916dc1eff84

Analysis

max time kernel
29s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13/06/2023, 20:15

Target

488d0f5201d8316ac97a68af9842542cbce31c67ac58395e4a5c0916dc1eff84.dll
Size

396KB
MD5

0c89c21cfbfae81414c2229880b62cb7
SHA1

668d28cb22d4f087c61da48aee6ce9a7aad20017
SHA256

488d0f5201d8316ac97a68af9842542cbce31c67ac58395e4a5c0916dc1eff84
SHA512

46a3c0551c0a39949cff782c73a662e1facab9ffd04f2b6c868ae6848d97f1424fcd910e773b9f673f79f5aa5d530ea059935a6d327cb1964d43be651b8e7109
SSDEEP

6144:NRxNEfP/tAdi7WPK67fTKkB6NNEt7JbuuM4Q6ZOKWrs9P3f2sBg21WY7:8ftEi7i7+k4ctJu1C8slP2sBgxY7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
772	1512	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 1512	916	rundll32.exe	27
PID 916 wrote to memory of 1512	916	rundll32.exe	27
PID 916 wrote to memory of 1512	916	rundll32.exe	27
PID 916 wrote to memory of 1512	916	rundll32.exe	27
PID 916 wrote to memory of 1512	916	rundll32.exe	27
PID 916 wrote to memory of 1512	916	rundll32.exe	27
PID 916 wrote to memory of 1512	916	rundll32.exe	27
PID 1512 wrote to memory of 772	1512	rundll32.exe	28
PID 1512 wrote to memory of 772	1512	rundll32.exe	28
PID 1512 wrote to memory of 772	1512	rundll32.exe	28
PID 1512 wrote to memory of 772	1512	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\488d0f5201d8316ac97a68af9842542cbce31c67ac58395e4a5c0916dc1eff84.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\488d0f5201d8316ac97a68af9842542cbce31c67ac58395e4a5c0916dc1eff84.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 228
    3⤵
    - Program crash
    PID:772

memory/1512-54-0x0000000010000000-0x000000001006B000-memory.dmp

Filesize
428KB

Download