9babb89c226f0eea74b57e467f6673c68ae019fcbc1d91f47f1a5c770ab083cb

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
17/08/2023, 15:17

Target

9babb89c226f0eea74b57e467f6673c68ae019fcbc1d91f47f1a5c770ab083cb.dll
Size

820KB
MD5

ae0671dd01e46199de0a42c05f4de0ab
SHA1

0ded14597d703a07f1e0202b0bb674877b48ffeb
SHA256

9babb89c226f0eea74b57e467f6673c68ae019fcbc1d91f47f1a5c770ab083cb
SHA512

e8b392d19417dcf96392f608625cdd11eed6e15285721df17014b34d25c49cd2cf36d8acd643fd44adec7bf6b3a41b5e8de58d58358b53ee2d4c82d71323d043
SSDEEP

12288:LS7ZCkG47KD7Odbe0ceqoyC6oGhieOHfQeN:ipv727IK0JqoyCeOHYeN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2136	2156	WerFault.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2156	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2156	3068	rundll32.exe	28
PID 3068 wrote to memory of 2156	3068	rundll32.exe	28
PID 3068 wrote to memory of 2156	3068	rundll32.exe	28
PID 3068 wrote to memory of 2156	3068	rundll32.exe	28
PID 3068 wrote to memory of 2156	3068	rundll32.exe	28
PID 3068 wrote to memory of 2156	3068	rundll32.exe	28
PID 3068 wrote to memory of 2156	3068	rundll32.exe	28
PID 2156 wrote to memory of 2136	2156	rundll32.exe	29
PID 2156 wrote to memory of 2136	2156	rundll32.exe	29
PID 2156 wrote to memory of 2136	2156	rundll32.exe	29
PID 2156 wrote to memory of 2136	2156	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9babb89c226f0eea74b57e467f6673c68ae019fcbc1d91f47f1a5c770ab083cb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9babb89c226f0eea74b57e467f6673c68ae019fcbc1d91f47f1a5c770ab083cb.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 272
    3⤵
    - Program crash
    PID:2136

memory/2156-53-0x00000000759C0000-0x0000000075AC0000-memory.dmp

Filesize
1024KB

Download
memory/2156-54-0x00000000759C0000-0x0000000075AC0000-memory.dmp

Filesize
1024KB

Download