12d32581acbfcfe59576440e3f182c098c29a0f1735efe7452690a686123fce1

Analysis

max time kernel
361s
max time network
377s
platform
windows7_x64
resource
win7-20230712-es
resource tags

arch:x64arch:x86image:win7-20230712-eslocale:es-esos:windows7-x64systemwindows
submitted
02/08/2023, 23:39

Target

Common Files/CtrlEx.dll
Size

44KB
MD5

d22986b4c4b4bab0da6be8f68fe952be
SHA1

6b98e89efcde94ac5917b333f2f6bd46ddaf8ead
SHA256

9d2bd8bcb35be07fd17a2b3fba3c543acf3a470c853ad9bae6e3b7f587eea739
SHA512

f731cba7dcee6bcbf4cb8a286db726a3a3a21bdca18a4f196942696e25d931d8c18eba55c497a3d31a5ab592bed817bda290d301d103a1acdd5717ac3ad5afd3
SSDEEP

384:wsflfkZf6fGAeib1uwMX7nVgWCoxXBZ74mG+4B91Ky8IZv:wdf6fGADb1uFny9oxvyvZv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
904	2272	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 2272	2260	rundll32.exe	28
PID 2260 wrote to memory of 2272	2260	rundll32.exe	28
PID 2260 wrote to memory of 2272	2260	rundll32.exe	28
PID 2260 wrote to memory of 2272	2260	rundll32.exe	28
PID 2260 wrote to memory of 2272	2260	rundll32.exe	28
PID 2260 wrote to memory of 2272	2260	rundll32.exe	28
PID 2260 wrote to memory of 2272	2260	rundll32.exe	28
PID 2272 wrote to memory of 904	2272	rundll32.exe	29
PID 2272 wrote to memory of 904	2272	rundll32.exe	29
PID 2272 wrote to memory of 904	2272	rundll32.exe	29
PID 2272 wrote to memory of 904	2272	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Common Files\CtrlEx.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Common Files\CtrlEx.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 256
    3⤵
    - Program crash
    PID:904

memory/2272-53-0x00000000000F0000-0x000000000010E000-memory.dmp

Filesize
120KB

Download
memory/2272-55-0x00000000006A0000-0x00000000006DE000-memory.dmp

Filesize
248KB

Download
memory/2272-57-0x0000000000110000-0x0000000000129000-memory.dmp

Filesize
100KB

Download
memory/2272-58-0x00000000006E0000-0x000000000070F000-memory.dmp

Filesize
188KB

Download
memory/2272-60-0x0000000001CC0000-0x00000000022C9000-memory.dmp

Filesize
6.0MB

Download
memory/2272-62-0x0000000000730000-0x000000000073D000-memory.dmp

Filesize
52KB

Download
memory/2272-63-0x00000000022D0000-0x00000000028A9000-memory.dmp

Filesize
5.8MB

Download