feef7c585a67e368ce1a514158d6abc280e502b0408ad8b589d83687360ff11f

Analysis

max time kernel
30s
max time network
34s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
29-06-2023 21:58

Target

50d0a3b32e813c671248f0f2fe10c3c237ee94bfa94fcaf86886fc3a64d79b88.dll
Size

60KB
MD5

af850c572f4805830df79180b04ae52e
SHA1

8261158838f46a63ea08dd9b0b45262247c371ac
SHA256

50d0a3b32e813c671248f0f2fe10c3c237ee94bfa94fcaf86886fc3a64d79b88
SHA512

2eec61676ecd902d79a7a266893861eff5903345aa7753e94ce7c3cffa0ba08c7c386a29a8148cc4caa1c7bc7410df08d29387745f9690b9f9a617d048c7604d
SSDEEP

768:AUmQgYEOvCZf8/gGB/RQCT4Is9OqC3sGs8qSardvWNhULPyKdUNexpRYhTr:+Qgle5bkIs91gsGsBZuN+LPyCaT

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1756 1600 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1756	1600	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 840 wrote to memory of 1600	840	rundll32.exe	rundll32.exe
PID 840 wrote to memory of 1600	840	rundll32.exe	rundll32.exe
PID 840 wrote to memory of 1600	840	rundll32.exe	rundll32.exe
PID 840 wrote to memory of 1600	840	rundll32.exe	rundll32.exe
PID 840 wrote to memory of 1600	840	rundll32.exe	rundll32.exe
PID 840 wrote to memory of 1600	840	rundll32.exe	rundll32.exe
PID 840 wrote to memory of 1600	840	rundll32.exe	rundll32.exe
PID 1600 wrote to memory of 1756	1600	rundll32.exe	WerFault.exe
PID 1600 wrote to memory of 1756	1600	rundll32.exe	WerFault.exe
PID 1600 wrote to memory of 1756	1600	rundll32.exe	WerFault.exe
PID 1600 wrote to memory of 1756	1600	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\50d0a3b32e813c671248f0f2fe10c3c237ee94bfa94fcaf86886fc3a64d79b88.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:840

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\50d0a3b32e813c671248f0f2fe10c3c237ee94bfa94fcaf86886fc3a64d79b88.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 196
3⤵
- Program crash
PID:1756