46f07aef4f14123d785610930d3c5b053b81211a085e93cf235698b96baeeb84

Analysis

max time kernel
25s
max time network
29s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
29/06/2023, 22:20

Target

46f07aef4f14123d785610930d3c5b053b81211a085e93cf235698b96baeeb84.dll
Size

3.2MB
MD5

e41891a9d3ab259189f1060ba943b414
SHA1

6e297cbaabe3ab02b39aa575185c8a45c3d0c7c4
SHA256

46f07aef4f14123d785610930d3c5b053b81211a085e93cf235698b96baeeb84
SHA512

d2cf318a464b4bf09130c63e77a07132bff32d64e250da407b58829d4c26c92fafd44de253fe00afd7e5203d3e67405cea3ab07032af65a331f712a0ae456b4c
SSDEEP

98304:BwiftZ5dmWIkn+U0bUArvq25JjgIg8mwaC:eKOWhb0bUP25FrjmwaC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1656	1660	WerFault.exe	26

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 1660	1572	rundll32.exe	26
PID 1572 wrote to memory of 1660	1572	rundll32.exe	26
PID 1572 wrote to memory of 1660	1572	rundll32.exe	26
PID 1572 wrote to memory of 1660	1572	rundll32.exe	26
PID 1572 wrote to memory of 1660	1572	rundll32.exe	26
PID 1572 wrote to memory of 1660	1572	rundll32.exe	26
PID 1572 wrote to memory of 1660	1572	rundll32.exe	26
PID 1660 wrote to memory of 1656	1660	rundll32.exe	27
PID 1660 wrote to memory of 1656	1660	rundll32.exe	27
PID 1660 wrote to memory of 1656	1660	rundll32.exe	27
PID 1660 wrote to memory of 1656	1660	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\46f07aef4f14123d785610930d3c5b053b81211a085e93cf235698b96baeeb84.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\46f07aef4f14123d785610930d3c5b053b81211a085e93cf235698b96baeeb84.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 252
    3⤵
    - Program crash
    PID:1656