93a4fc857442c6656aab827dc0473f750aff1bfeccf04494a8c40ce82429137a

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
16-08-2023 15:34

Target

93a4fc857442c6656aab827dc0473f750aff1bfeccf04494a8c40ce82429137a.dll
Size

14KB
MD5

3ad8bd351184e8c7cd20b2bd5ae13830
SHA1

91d5d8afc89d0668b2bac47bbba0eb1d7d6d4bb6
SHA256

93a4fc857442c6656aab827dc0473f750aff1bfeccf04494a8c40ce82429137a
SHA512

07a0754df14f6fdf9c04d301fe3789280bc86b372eec3d687fee7d752478b9f916f4c06cd66c5e3ac116e14ad293789bc8ee3c4a70a9f1067db3ca0a9404d398
SSDEEP

192:KJqdPoX+9jua12QWCjOhUhpsrDWosxQ+1yg/3MpFv2cRV:O+1D120jRhpP/AvRRV

Score

8^/10

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	2560	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2520	2560	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 2560	1136	rundll32.exe	28
PID 1136 wrote to memory of 2560	1136	rundll32.exe	28
PID 1136 wrote to memory of 2560	1136	rundll32.exe	28
PID 1136 wrote to memory of 2560	1136	rundll32.exe	28
PID 1136 wrote to memory of 2560	1136	rundll32.exe	28
PID 1136 wrote to memory of 2560	1136	rundll32.exe	28
PID 1136 wrote to memory of 2560	1136	rundll32.exe	28
PID 2560 wrote to memory of 2520	2560	rundll32.exe	29
PID 2560 wrote to memory of 2520	2560	rundll32.exe	29
PID 2560 wrote to memory of 2520	2560	rundll32.exe	29
PID 2560 wrote to memory of 2520	2560	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\93a4fc857442c6656aab827dc0473f750aff1bfeccf04494a8c40ce82429137a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\93a4fc857442c6656aab827dc0473f750aff1bfeccf04494a8c40ce82429137a.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 248
    3⤵
    - Program crash
    PID:2520

memory/2560-54-0x00000000001C0000-0x00000000001F5000-memory.dmp

Filesize
212KB

Download
memory/2560-55-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/2560-56-0x0000000000250000-0x0000000000288000-memory.dmp

Filesize
224KB

Download
memory/2560-57-0x00000000001C0000-0x00000000001F5000-memory.dmp

Filesize
212KB

Download