12d32581acbfcfe59576440e3f182c098c29a0f1735efe7452690a686123fce1

Analysis

max time kernel
361s
max time network
369s
platform
windows7_x64
resource
win7-20230712-es
resource tags

arch:x64arch:x86image:win7-20230712-eslocale:es-esos:windows7-x64systemwindows
submitted
02/08/2023, 23:39

Target

Common Files/Ctrls.dll
Size

668KB
MD5

3c1581dd42e97ef3886b6ae8cb183605
SHA1

664d330db7ed71bbe15027ad4e40063218c8fc74
SHA256

e8f2d779556d959e4a89f072a4d78197cf5d0e20e5cfa3491103ea8814ff7796
SHA512

b05a76eac54e4717dd247c4ba2e4c6e7e0591a025645dcf82dfe11321980dac5f7854b4bbd89ba090230a58857241327f10682a89504d9f405cca2bf95dbd626
SSDEEP

12288:sENUPy7fv0z/ETy7mWRFa6Fbu+YH6H6/RtdrBYn9M0EQqn7F2/bCPH9ZfBL52efh:sRPZ/EUVRFtbu+zqRtdrBYnFdW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2556	1768	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 1768	1676	rundll32.exe	28
PID 1676 wrote to memory of 1768	1676	rundll32.exe	28
PID 1676 wrote to memory of 1768	1676	rundll32.exe	28
PID 1676 wrote to memory of 1768	1676	rundll32.exe	28
PID 1676 wrote to memory of 1768	1676	rundll32.exe	28
PID 1676 wrote to memory of 1768	1676	rundll32.exe	28
PID 1676 wrote to memory of 1768	1676	rundll32.exe	28
PID 1768 wrote to memory of 2556	1768	rundll32.exe	29
PID 1768 wrote to memory of 2556	1768	rundll32.exe	29
PID 1768 wrote to memory of 2556	1768	rundll32.exe	29
PID 1768 wrote to memory of 2556	1768	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Common Files\Ctrls.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Common Files\Ctrls.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1768
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 296
    3⤵
    - Program crash
    PID:2556

memory/1768-54-0x00000000001E0000-0x000000000020C000-memory.dmp

Filesize
176KB

Download
memory/1768-56-0x0000000000140000-0x000000000014D000-memory.dmp

Filesize
52KB

Download
memory/1768-57-0x0000000000210000-0x0000000000229000-memory.dmp

Filesize
100KB

Download
memory/1768-58-0x00000000002D0000-0x000000000030E000-memory.dmp

Filesize
248KB

Download
memory/1768-60-0x0000000000310000-0x000000000033F000-memory.dmp

Filesize
188KB

Download
memory/1768-62-0x0000000001E60000-0x0000000002469000-memory.dmp

Filesize
6.0MB

Download
memory/1768-64-0x0000000002470000-0x0000000002A49000-memory.dmp

Filesize
5.8MB

Download