41ee2596e4414bb15e636cfa38ca6f59b2decee9fd8a7e5a835a212621957a23

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
20-06-2023 20:45

Target

41ee2596e4414bb15e636cfa38ca6f59b2decee9fd8a7e5a835a212621957a23.dll
Size

1.1MB
MD5

817d87bc6c75320d89b0cd2e614e0dea
SHA1

bacfc6d09c8f25bab81f85c99d2778091aa9c9e4
SHA256

41ee2596e4414bb15e636cfa38ca6f59b2decee9fd8a7e5a835a212621957a23
SHA512

59da3147c8444a720f746c3e74015f63306bb535bd65662c6ed2af7ef8dc251664629816b36b18c988e8e805f8554a11112ac54eb9cdb9c2510f15986b0a7167
SSDEEP

24576:SXl7yCqVU16/PllX/vZe/IlaJdjKT172O74RJugoSg1Ia:Aqtp/xonJdE7R4RJugol1Ia

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1348 1868 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1348	1868	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1532 wrote to memory of 1868	1532	rundll32.exe	rundll32.exe
PID 1532 wrote to memory of 1868	1532	rundll32.exe	rundll32.exe
PID 1532 wrote to memory of 1868	1532	rundll32.exe	rundll32.exe
PID 1532 wrote to memory of 1868	1532	rundll32.exe	rundll32.exe
PID 1532 wrote to memory of 1868	1532	rundll32.exe	rundll32.exe
PID 1532 wrote to memory of 1868	1532	rundll32.exe	rundll32.exe
PID 1532 wrote to memory of 1868	1532	rundll32.exe	rundll32.exe
PID 1868 wrote to memory of 1348	1868	rundll32.exe	WerFault.exe
PID 1868 wrote to memory of 1348	1868	rundll32.exe	WerFault.exe
PID 1868 wrote to memory of 1348	1868	rundll32.exe	WerFault.exe
PID 1868 wrote to memory of 1348	1868	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\41ee2596e4414bb15e636cfa38ca6f59b2decee9fd8a7e5a835a212621957a23.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1532

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\41ee2596e4414bb15e636cfa38ca6f59b2decee9fd8a7e5a835a212621957a23.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 228
3⤵
- Program crash
PID:1348