b27ac7ca0dd519757dd062bac896870069a8af38e8cc550d5ad8f15574506286

Analysis

max time kernel
141s
max time network
126s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
21/08/2023, 19:25

Target

b27ac7ca0dd519757dd062bac896870069a8af38e8cc550d5ad8f15574506286.dll
Size

261KB
MD5

b134bd4af4c721cbfe2a5f67cdf5a6f3
SHA1

1ceafa87475b99fd977bada2feed0a56fb28f7ba
SHA256

b27ac7ca0dd519757dd062bac896870069a8af38e8cc550d5ad8f15574506286
SHA512

a04b3a0e2f39b9f329cd46c9f31724b9547f4462b5861fc9398c42bad3ff6ff8994a5219a0dd8ea1f17015cc5165aba9b00c15448e458272be4bd8431364701f
SSDEEP

3072:zsJufjxKGFTIMVRZf0fh5D9ws0kOYHRtMZ+niwcOR5iOVGBTUX:4ufjxKGqMVrc3F0kGBTa

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2068	2052	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2052	2532	rundll32.exe	28
PID 2532 wrote to memory of 2052	2532	rundll32.exe	28
PID 2532 wrote to memory of 2052	2532	rundll32.exe	28
PID 2532 wrote to memory of 2052	2532	rundll32.exe	28
PID 2532 wrote to memory of 2052	2532	rundll32.exe	28
PID 2532 wrote to memory of 2052	2532	rundll32.exe	28
PID 2532 wrote to memory of 2052	2532	rundll32.exe	28
PID 2052 wrote to memory of 2068	2052	rundll32.exe	29
PID 2052 wrote to memory of 2068	2052	rundll32.exe	29
PID 2052 wrote to memory of 2068	2052	rundll32.exe	29
PID 2052 wrote to memory of 2068	2052	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b27ac7ca0dd519757dd062bac896870069a8af38e8cc550d5ad8f15574506286.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b27ac7ca0dd519757dd062bac896870069a8af38e8cc550d5ad8f15574506286.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 240
    3⤵
    - Program crash
    PID:2068

memory/2052-53-0x0000000068100000-0x000000006814B000-memory.dmp

Filesize
300KB

Download