12d32581acbfcfe59576440e3f182c098c29a0f1735efe7452690a686123fce1

Analysis

max time kernel
361s
max time network
373s
platform
windows7_x64
resource
win7-20230712-es
resource tags

arch:x64arch:x86image:win7-20230712-eslocale:es-esos:windows7-x64systemwindows
submitted
02/08/2023, 23:39

Target

Common Files/Appliance.dll
Size

80KB
MD5

bba8f3421553805b378f452dffb365c8
SHA1

4b1de7056ce163f5ef813bd00a2eb41aece0a646
SHA256

476f6241542e7a881dcc09aa313d3582fcc7c28ba1c33314fe5f094277b6116b
SHA512

14e59305d0b54e5714680065f0fa5b574fe39e2e7ab9d1602f4a2656a4abb2caf0df919476b8c760993ff2ecbf8f645c7e123667816246e4bf3d27cface679f9
SSDEEP

768:QcXnH5UAIts51rvqIjqAyoyTTitBXoQx3ALHo1GNlBLlZCDs+sed0RaImDuWfUKq:bZbIudtqToyTTUYKt0RnC7s5FwuWDLC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2800	2688	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 2688	1084	rundll32.exe	28
PID 1084 wrote to memory of 2688	1084	rundll32.exe	28
PID 1084 wrote to memory of 2688	1084	rundll32.exe	28
PID 1084 wrote to memory of 2688	1084	rundll32.exe	28
PID 1084 wrote to memory of 2688	1084	rundll32.exe	28
PID 1084 wrote to memory of 2688	1084	rundll32.exe	28
PID 1084 wrote to memory of 2688	1084	rundll32.exe	28
PID 2688 wrote to memory of 2800	2688	rundll32.exe	29
PID 2688 wrote to memory of 2800	2688	rundll32.exe	29
PID 2688 wrote to memory of 2800	2688	rundll32.exe	29
PID 2688 wrote to memory of 2800	2688	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Common Files\Appliance.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Common Files\Appliance.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 240
    3⤵
    - Program crash
    PID:2800