65d38305a8b68c0a00cb7133612777acd4cc9f4c2e770cf4adbf392172a32227

Resubmissions

18-07-2023 14:28

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
18-07-2023 14:28

Target

baselib.dll
Size

409KB
MD5

2b4c7a7fbf24865ad22e87558f0ab37f
SHA1

a86dbe84380585dd398ffbbca303857bdd03fab9
SHA256

65344274e68661d40c045ce9b0de74c6ad18dd800af56a358a0a9bd1670a27a4
SHA512

e77159c64c2606ce4c749bf0240ed217653ed6eee44a17161e1c9a291393accb38453cc7228a4f59c6b0cc1084d8e65c6400d9e1cfa25e6e226b7ad45f4f6414
SSDEEP

6144:sjk5dSv+prhS0HxBnfBRsdgVStUgQdXEqkKa92xQd1D3pe44KFOFEjGbspp:yk5dSGpl10dqStAQKa92x4JsEI+p

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2196 3012 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2196	3012	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3012 wrote to memory of 2196	3012	rundll32.exe	WerFault.exe
PID 3012 wrote to memory of 2196	3012	rundll32.exe	WerFault.exe
PID 3012 wrote to memory of 2196	3012	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\baselib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3012 -s 84
  2⤵
  - Program crash
  PID:2196