4faa1658f4161b6fd9448311d9e4784177041641e8ef42b4c0a7b9786355feaa

Analysis

max time kernel
29s
max time network
31s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
27/06/2023, 19:12

Target

4faa1658f4161b6fd9448311d9e4784177041641e8ef42b4c0a7b9786355feaa.dll
Size

512KB
MD5

0397262b72985da69b2ae1a6be1c8e45
SHA1

145c0231ccab94b65fa5f200d28a157383105475
SHA256

4faa1658f4161b6fd9448311d9e4784177041641e8ef42b4c0a7b9786355feaa
SHA512

a0aa634af3129f88cdf06c4c9cc0cc7543b0a14a36e85809f3a228b0a935b0088daa29c6e2ca99b4aead6415ef1cc62955f07bb6c8181bac312f86d95b924f65
SSDEEP

6144:vslZ0VZXqjGbTtqqqqqqqqqqqqqqqqqqqqqqqqqSDukMlqe:kunPN4l9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1524	1264	WerFault.exe	27

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 1264	1628	rundll32.exe	27
PID 1628 wrote to memory of 1264	1628	rundll32.exe	27
PID 1628 wrote to memory of 1264	1628	rundll32.exe	27
PID 1628 wrote to memory of 1264	1628	rundll32.exe	27
PID 1628 wrote to memory of 1264	1628	rundll32.exe	27
PID 1628 wrote to memory of 1264	1628	rundll32.exe	27
PID 1628 wrote to memory of 1264	1628	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4faa1658f4161b6fd9448311d9e4784177041641e8ef42b4c0a7b9786355feaa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4faa1658f4161b6fd9448311d9e4784177041641e8ef42b4c0a7b9786355feaa.dll,#1
  2⤵
  PID:1264
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 268
    3⤵
    - Program crash
    PID:1524