d6fab519a37cf97a3bf27199d8256ecc6e93259c76bb17be949003dd149641e3

Analysis

max time kernel
28s
max time network
31s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
02/07/2023, 19:24

Target

Malicious_d6fab519a37cf97a3bf27199d8256ecc6e93259c76bb17be949003dd149641e3.dll
Size

105KB
MD5

db77672c114add499dbc2cbba2ed0967
SHA1

3cfdeb96edb7f248850cc54f613a1f68de2ca2e1
SHA256

d6fab519a37cf97a3bf27199d8256ecc6e93259c76bb17be949003dd149641e3
SHA512

beaa8fe3a4ada529d96c663c6d3cfa33d8bd30d22191a380611b7ccc2848fa67b43bf122df9e6d6847b46c9382409f01e41620c01ff8e760ee05d9d588ece9f6
SSDEEP

1536:yAjY1872HkwP9Vsu0x/hxInFnW2/D6tUAYzs8jcdoMU1MQEBuSpS7TRgld:yAIL0dhxIdWOaoMU2zuES7TRgz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1728	2040	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2040	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2040	2028	rundll32.exe	28
PID 2028 wrote to memory of 2040	2028	rundll32.exe	28
PID 2028 wrote to memory of 2040	2028	rundll32.exe	28
PID 2028 wrote to memory of 2040	2028	rundll32.exe	28
PID 2028 wrote to memory of 2040	2028	rundll32.exe	28
PID 2028 wrote to memory of 2040	2028	rundll32.exe	28
PID 2028 wrote to memory of 2040	2028	rundll32.exe	28
PID 2040 wrote to memory of 1728	2040	rundll32.exe	29
PID 2040 wrote to memory of 1728	2040	rundll32.exe	29
PID 2040 wrote to memory of 1728	2040	rundll32.exe	29
PID 2040 wrote to memory of 1728	2040	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Malicious_d6fab519a37cf97a3bf27199d8256ecc6e93259c76bb17be949003dd149641e3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Malicious_d6fab519a37cf97a3bf27199d8256ecc6e93259c76bb17be949003dd149641e3.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 224
    3⤵
    - Program crash
    PID:1728