12d32581acbfcfe59576440e3f182c098c29a0f1735efe7452690a686123fce1

Analysis

max time kernel
359s
max time network
368s
platform
windows7_x64
resource
win7-20230712-es
resource tags

arch:x64arch:x86image:win7-20230712-eslocale:es-esos:windows7-x64systemwindows
submitted
02/08/2023, 23:39

Target

Common Files/Common.dll
Size

224KB
MD5

9fbd11d7b43d9c8a96fbcb15bae1f978
SHA1

f1e6925731a4c437bd07e3f9ad4d63854e602ee5
SHA256

870d629095dffc8085358572393936e722416e22a610f524b1857c3ae9b66593
SHA512

6ec05b74552db8265de6fd56d659606c802b79c08d9cbe3f7e135d47cfbf24ea98e9fdf2d1e2c753ae109f7bc3df61dd2a82e9b6d7dca805bc0df2b8f5dbd79d
SSDEEP

3072:ibGkND9kmQEIgnb6eMg6xYQ88hY0mYBfLuRE6FzUvCEcNgorwEseDFACJ:iSJrElb6w8bBfLubUvCtgQwEseK0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2240	1596	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 1596	1060	rundll32.exe	28
PID 1060 wrote to memory of 1596	1060	rundll32.exe	28
PID 1060 wrote to memory of 1596	1060	rundll32.exe	28
PID 1060 wrote to memory of 1596	1060	rundll32.exe	28
PID 1060 wrote to memory of 1596	1060	rundll32.exe	28
PID 1060 wrote to memory of 1596	1060	rundll32.exe	28
PID 1060 wrote to memory of 1596	1060	rundll32.exe	28
PID 1596 wrote to memory of 2240	1596	rundll32.exe	29
PID 1596 wrote to memory of 2240	1596	rundll32.exe	29
PID 1596 wrote to memory of 2240	1596	rundll32.exe	29
PID 1596 wrote to memory of 2240	1596	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Common Files\Common.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Common Files\Common.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1596
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 256
    3⤵
    - Program crash
    PID:2240

memory/1596-54-0x00000000000B0000-0x00000000000C9000-memory.dmp

Filesize
100KB

Download
memory/1596-55-0x00000000006E0000-0x000000000070F000-memory.dmp

Filesize
188KB

Download
memory/1596-57-0x0000000002030000-0x0000000002639000-memory.dmp

Filesize
6.0MB

Download
memory/1596-59-0x0000000000130000-0x000000000013D000-memory.dmp

Filesize
52KB

Download
memory/1596-60-0x0000000002640000-0x0000000002C19000-memory.dmp

Filesize
5.8MB

Download