8642277427b19c4f6485734e7d1568267a10bf3c8fd87bf2462078c2a9406ea4

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
21-08-2023 06:02

Target

8642277427b19c4f6485734e7d1568267a10bf3c8fd87bf2462078c2a9406ea4.dll
Size

179KB
MD5

594bbad8be5c0c09479408af307a683c
SHA1

9dd3287b65209621c04a1d8e8c0b37ab02bd79aa
SHA256

8642277427b19c4f6485734e7d1568267a10bf3c8fd87bf2462078c2a9406ea4
SHA512

5785bffb355c336108a8f59d95008c16e97939c4b8fcd9db789b7b2e4279b46cf23756bb8a0b634a92488cf943d2917a0bebb33a4ce602e30015676cb6dd6f41
SSDEEP

3072:btoDWPeOBtvlQJ7kfZG8nelEiDgmG6OAg0Fuj0wgf/N1YsIRxm:tztvl87kfZqOtAOKPYsIq

Score

8^/10

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	1080	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2648	1080	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 1080	2616	rundll32.exe	28
PID 2616 wrote to memory of 1080	2616	rundll32.exe	28
PID 2616 wrote to memory of 1080	2616	rundll32.exe	28
PID 2616 wrote to memory of 1080	2616	rundll32.exe	28
PID 2616 wrote to memory of 1080	2616	rundll32.exe	28
PID 2616 wrote to memory of 1080	2616	rundll32.exe	28
PID 2616 wrote to memory of 1080	2616	rundll32.exe	28
PID 1080 wrote to memory of 2648	1080	rundll32.exe	29
PID 1080 wrote to memory of 2648	1080	rundll32.exe	29
PID 1080 wrote to memory of 2648	1080	rundll32.exe	29
PID 1080 wrote to memory of 2648	1080	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8642277427b19c4f6485734e7d1568267a10bf3c8fd87bf2462078c2a9406ea4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8642277427b19c4f6485734e7d1568267a10bf3c8fd87bf2462078c2a9406ea4.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of WriteProcessMemory
  PID:1080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 248
    3⤵
    - Program crash
    PID:2648

memory/1080-54-0x0000000000130000-0x0000000000165000-memory.dmp

Filesize
212KB

Download
memory/1080-55-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/1080-56-0x0000000000360000-0x0000000000398000-memory.dmp

Filesize
224KB

Download
memory/1080-57-0x0000000000130000-0x0000000000165000-memory.dmp

Filesize
212KB

Download