f7ac987882f0ad78abe92b52182fe7f4658d2b515faa7912b3183421b59e5980

Analysis

max time kernel
141s
max time network
30s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
24-06-2023 21:59

Target

f7ac987882f0ad78abe92b52182fe7f4658d2b515faa7912b3183421b59e5980.dll
Size

3.2MB
MD5

c2f6aa00ccab98cf1d624d7f4d64f9fc
SHA1

f9b7b0362df0eeaa088a00fdc7fc9d94ecb20a1e
SHA256

f7ac987882f0ad78abe92b52182fe7f4658d2b515faa7912b3183421b59e5980
SHA512

dd748004322408d47ba645c369604cdb1212418a80d336141a6f0581f2131a381d5df132bdd443785561b1c93abbad994ddec95579eb261df7b3743d3e126500
SSDEEP

98304:TZRrSbPkNXW2FEYJoH5aQ2RKludCIuTvtlByI:TLrSbMNmcEYJoZ9luaFlj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

588 1288 WerFault.exe rundll32.exe

pid	pid_target	process	target process
588	1288	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1284 wrote to memory of 1288	1284	rundll32.exe	rundll32.exe
PID 1284 wrote to memory of 1288	1284	rundll32.exe	rundll32.exe
PID 1284 wrote to memory of 1288	1284	rundll32.exe	rundll32.exe
PID 1284 wrote to memory of 1288	1284	rundll32.exe	rundll32.exe
PID 1284 wrote to memory of 1288	1284	rundll32.exe	rundll32.exe
PID 1284 wrote to memory of 1288	1284	rundll32.exe	rundll32.exe
PID 1284 wrote to memory of 1288	1284	rundll32.exe	rundll32.exe
PID 1288 wrote to memory of 588	1288	rundll32.exe	WerFault.exe
PID 1288 wrote to memory of 588	1288	rundll32.exe	WerFault.exe
PID 1288 wrote to memory of 588	1288	rundll32.exe	WerFault.exe
PID 1288 wrote to memory of 588	1288	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7ac987882f0ad78abe92b52182fe7f4658d2b515faa7912b3183421b59e5980.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1284

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7ac987882f0ad78abe92b52182fe7f4658d2b515faa7912b3183421b59e5980.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 248
3⤵
- Program crash
PID:588

memory/1288-54-0x0000000002120000-0x0000000002EBF000-memory.dmp

Filesize
13.6MB

Download
memory/1288-55-0x0000000002120000-0x0000000002EBF000-memory.dmp

Filesize
13.6MB

Download
memory/1288-56-0x0000000002120000-0x0000000002EBF000-memory.dmp

Filesize
13.6MB

Download
memory/1288-57-0x0000000002120000-0x0000000002EBF000-memory.dmp

Filesize
13.6MB

Download
memory/1288-58-0x0000000002120000-0x0000000002EBF000-memory.dmp

Filesize
13.6MB

Download
memory/1288-59-0x0000000002120000-0x0000000002EBF000-memory.dmp

Filesize
13.6MB

Download
memory/1288-60-0x0000000002120000-0x0000000002EBF000-memory.dmp

Filesize
13.6MB

Download
memory/1288-61-0x0000000002120000-0x0000000002EBF000-memory.dmp

Filesize
13.6MB

Download
memory/1288-64-0x0000000002120000-0x0000000002EBF000-memory.dmp

Filesize
13.6MB

Download