cbd0b8619eb869150c192d4489b6784b9575a6121bdc7fe89ecee0fa2ee78a96

Analysis

max time kernel
141s
max time network
33s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
28/06/2023, 20:06

Target

cbd0b8619eb869150c192d4489b6784b9575a6121bdc7fe89ecee0fa2ee78a96.dll
Size

426KB
MD5

89322960bffc0388ae5bbee3918a9c24
SHA1

ec8aa95c311710fe2c39356153290821f65122e5
SHA256

cbd0b8619eb869150c192d4489b6784b9575a6121bdc7fe89ecee0fa2ee78a96
SHA512

b5f53f5f5746920845e4be0e51c51fa1d970448f0b66cf8fa220700960087ed5893ca5203f97cb58d65f27683d7e2ede7f5d64d3c256d3c552ea8c5fcb2c9147
SSDEEP

6144:aBtOOxUQ1tKMl8BMFJHNFkWWfjntVMaWdNG9iXRq0AqhlKybVeVg1WbHRtbNBikQ:aB+QJHIWWffWTGE8jyUZDNEirK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2004	1992	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 1992	1060	rundll32.exe	27
PID 1060 wrote to memory of 1992	1060	rundll32.exe	27
PID 1060 wrote to memory of 1992	1060	rundll32.exe	27
PID 1060 wrote to memory of 1992	1060	rundll32.exe	27
PID 1060 wrote to memory of 1992	1060	rundll32.exe	27
PID 1060 wrote to memory of 1992	1060	rundll32.exe	27
PID 1060 wrote to memory of 1992	1060	rundll32.exe	27
PID 1992 wrote to memory of 2004	1992	rundll32.exe	28
PID 1992 wrote to memory of 2004	1992	rundll32.exe	28
PID 1992 wrote to memory of 2004	1992	rundll32.exe	28
PID 1992 wrote to memory of 2004	1992	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cbd0b8619eb869150c192d4489b6784b9575a6121bdc7fe89ecee0fa2ee78a96.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cbd0b8619eb869150c192d4489b6784b9575a6121bdc7fe89ecee0fa2ee78a96.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 264
    3⤵
    - Program crash
    PID:2004

memory/1992-54-0x0000000000820000-0x0000000000940000-memory.dmp

Filesize
1.1MB

Download
memory/1992-55-0x0000000000820000-0x0000000000940000-memory.dmp

Filesize
1.1MB

Download
memory/1992-56-0x0000000000820000-0x0000000000940000-memory.dmp

Filesize
1.1MB

Download