445b9c2bc1737018cc1482abbc5eab105d1329c78e9f4ab66bbd63142322276b

Analysis

max time kernel
142s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
19-06-2023 19:07

Target

445b9c2bc1737018cc1482abbc5eab105d1329c78e9f4ab66bbd63142322276b.dll
Size

944KB
MD5

c9b2740e31322588e5f66a97a35322f4
SHA1

869a2cc3714cac7e1b358cb64b5944572bf2a6b4
SHA256

445b9c2bc1737018cc1482abbc5eab105d1329c78e9f4ab66bbd63142322276b
SHA512

ab07ebbbe238a6a29ef33070708f14f763b3b4199843477e9fba794da4d61ba0e6c7a35024a409c8ce67b15abebb8ff18f79ee496bffed4fdb840e7aee6be8e9
SSDEEP

24576:wP9TyHzDlTUmwCd36PU2r9HBqaSXVGHY5bm7:w1eTZ4mVoZHAaAsHY5i7

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1364 1568 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1364	1568	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1524 wrote to memory of 1568	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 1568	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 1568	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 1568	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 1568	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 1568	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 1568	1524	rundll32.exe	rundll32.exe
PID 1568 wrote to memory of 1364	1568	rundll32.exe	WerFault.exe
PID 1568 wrote to memory of 1364	1568	rundll32.exe	WerFault.exe
PID 1568 wrote to memory of 1364	1568	rundll32.exe	WerFault.exe
PID 1568 wrote to memory of 1364	1568	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\445b9c2bc1737018cc1482abbc5eab105d1329c78e9f4ab66bbd63142322276b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1524

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\445b9c2bc1737018cc1482abbc5eab105d1329c78e9f4ab66bbd63142322276b.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 320
3⤵
- Program crash
PID:1364

memory/1568-55-0x0000000001E70000-0x0000000002106000-memory.dmp

Filesize
2.6MB

Download
memory/1568-56-0x0000000001E70000-0x0000000002106000-memory.dmp

Filesize
2.6MB

Download
memory/1568-54-0x0000000001E70000-0x0000000002106000-memory.dmp

Filesize
2.6MB

Download
memory/1568-57-0x0000000001E70000-0x0000000002106000-memory.dmp

Filesize
2.6MB

Download
memory/1568-58-0x0000000001E70000-0x0000000002106000-memory.dmp

Filesize
2.6MB

Download
memory/1568-59-0x0000000001E70000-0x0000000002106000-memory.dmp

Filesize
2.6MB

Download