5b5cf608b31567ae075d092a726d2945dbd14def29c9aeccc96a8b85f8d94c1d

Analysis

max time kernel
146s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
19-06-2023 19:14

Target

5b5cf608b31567ae075d092a726d2945dbd14def29c9aeccc96a8b85f8d94c1d.dll
Size

952KB
MD5

8a9679ee57fdea6c0358e6d1bf45f45f
SHA1

77ea76f3aae239c0711d639b33eca3bd47ab33cf
SHA256

5b5cf608b31567ae075d092a726d2945dbd14def29c9aeccc96a8b85f8d94c1d
SHA512

e3a0919193cce27d8601671d9d3058933694802937082e9cd3c8f982f4beadd194361770c728f5bf426a526aada33252437cb10afa8a93bb6cf570be0ae37c4e
SSDEEP

24576:8yQB/bF1owbwz1fy1UTqW11ZiTARnjgIOpagkxy7Ueg85u:8d9TdW1fy1UTqw1ZCsjCkqG

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1188 888 WerFault.exe rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

888 rundll32.exe

pid	pid_target	process	target process
1188	888	WerFault.exe	rundll32.exe

pid	process
888	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1376 wrote to memory of 888	1376	rundll32.exe	rundll32.exe
PID 1376 wrote to memory of 888	1376	rundll32.exe	rundll32.exe
PID 1376 wrote to memory of 888	1376	rundll32.exe	rundll32.exe
PID 1376 wrote to memory of 888	1376	rundll32.exe	rundll32.exe
PID 1376 wrote to memory of 888	1376	rundll32.exe	rundll32.exe
PID 1376 wrote to memory of 888	1376	rundll32.exe	rundll32.exe
PID 1376 wrote to memory of 888	1376	rundll32.exe	rundll32.exe
PID 888 wrote to memory of 1188	888	rundll32.exe	WerFault.exe
PID 888 wrote to memory of 1188	888	rundll32.exe	WerFault.exe
PID 888 wrote to memory of 1188	888	rundll32.exe	WerFault.exe
PID 888 wrote to memory of 1188	888	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b5cf608b31567ae075d092a726d2945dbd14def29c9aeccc96a8b85f8d94c1d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 888 -s 324
3⤵
- Program crash
PID:1188

memory/888-54-0x00000000022C0000-0x00000000025F4000-memory.dmp

Filesize
3.2MB

Download
memory/888-55-0x00000000022C0000-0x00000000025F4000-memory.dmp

Filesize
3.2MB

Download
memory/888-56-0x00000000022C0000-0x00000000025F4000-memory.dmp

Filesize
3.2MB

Download
memory/888-57-0x00000000022C0000-0x00000000025F4000-memory.dmp

Filesize
3.2MB

Download
memory/888-59-0x00000000022C0000-0x00000000025F4000-memory.dmp

Filesize
3.2MB

Download
memory/888-60-0x00000000022C0000-0x00000000025F4000-memory.dmp

Filesize
3.2MB

Download
memory/888-61-0x00000000022C0000-0x00000000025F4000-memory.dmp

Filesize
3.2MB

Download
memory/888-58-0x00000000022C0000-0x00000000025F4000-memory.dmp

Filesize
3.2MB

Download
memory/888-62-0x00000000022C0000-0x00000000025F4000-memory.dmp

Filesize
3.2MB

Download