cd3b542fae4893e9ee92b644448677ecb71c47e9f2300d4b3fd4d86aa3efc6ba

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
13-07-2023 17:25

Target

00b48568a42b58exe_JC.dll
Size

203KB
MD5

00b48568a42b58057941a4dbdba8bd25
SHA1

c4d1110592800069fecbf610ea38df53b75a7c06
SHA256

cd3b542fae4893e9ee92b644448677ecb71c47e9f2300d4b3fd4d86aa3efc6ba
SHA512

bdf9979297bc24c20b6c32f4200dce628db012fbbd28763196faae4d91862ce6ea85a1f8bb8ca792ca7ead40b04fba44142a708412d8f974d689d2ef4904b246
SSDEEP

3072:PYaW8qUEflaASmkDs1oo8CUS5D+u73vqQ+z+F62hAxquMfgj5jdUy5sZ:PFHEfoAaDQoo8CUwxTvhU+F66fgVj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1976 2232 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1976	2232	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1180 wrote to memory of 2232	1180	rundll32.exe	rundll32.exe
PID 1180 wrote to memory of 2232	1180	rundll32.exe	rundll32.exe
PID 1180 wrote to memory of 2232	1180	rundll32.exe	rundll32.exe
PID 1180 wrote to memory of 2232	1180	rundll32.exe	rundll32.exe
PID 1180 wrote to memory of 2232	1180	rundll32.exe	rundll32.exe
PID 1180 wrote to memory of 2232	1180	rundll32.exe	rundll32.exe
PID 1180 wrote to memory of 2232	1180	rundll32.exe	rundll32.exe
PID 2232 wrote to memory of 1976	2232	rundll32.exe	WerFault.exe
PID 2232 wrote to memory of 1976	2232	rundll32.exe	WerFault.exe
PID 2232 wrote to memory of 1976	2232	rundll32.exe	WerFault.exe
PID 2232 wrote to memory of 1976	2232	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00b48568a42b58exe_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1180

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00b48568a42b58exe_JC.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 232
3⤵
- Program crash
PID:1976