75f0b4f779dd84e9f51c83365a0d93fedd38cf8542b5ba2839d453bfecf7473d

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
20/08/2023, 10:12

Target

75f0b4f779dd84e9f51c83365a0d93fedd38cf8542b5ba2839d453bfecf7473d.dll
Size

534KB
MD5

e9ffa17ba62cdb9f8151d66cbae63c59
SHA1

490e2f6a370793862e0d2f6e5747bd76c4abe7ad
SHA256

75f0b4f779dd84e9f51c83365a0d93fedd38cf8542b5ba2839d453bfecf7473d
SHA512

210616e2ebbd4090c5ad2c2301c876fc8f698b9428da13492cee21947c98829a214b2ed087b6d17099c3586191d3104879024514e29392b56638b9bcf3402021
SSDEEP

12288:Gkk/+xBP9vD7mgQjKIDnwpXvGUE3AVZHkTNBwOwYG8yik:GkpPXI0pXvGUE3YH8NlXNyv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1620	2120	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2120	2088	rundll32.exe	28
PID 2088 wrote to memory of 2120	2088	rundll32.exe	28
PID 2088 wrote to memory of 2120	2088	rundll32.exe	28
PID 2088 wrote to memory of 2120	2088	rundll32.exe	28
PID 2088 wrote to memory of 2120	2088	rundll32.exe	28
PID 2088 wrote to memory of 2120	2088	rundll32.exe	28
PID 2088 wrote to memory of 2120	2088	rundll32.exe	28
PID 2120 wrote to memory of 1620	2120	rundll32.exe	29
PID 2120 wrote to memory of 1620	2120	rundll32.exe	29
PID 2120 wrote to memory of 1620	2120	rundll32.exe	29
PID 2120 wrote to memory of 1620	2120	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\75f0b4f779dd84e9f51c83365a0d93fedd38cf8542b5ba2839d453bfecf7473d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\75f0b4f779dd84e9f51c83365a0d93fedd38cf8542b5ba2839d453bfecf7473d.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2120
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 224
    3⤵
    - Program crash
    PID:1620