4a1b6cfd5bd497571f88e2cbf302d5d5ccc29f5939950bac947765afe0a70181

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
23/08/2023, 04:12

Target

4a1b6cfd5bd497571f88e2cbf302d5d5ccc29f5939950bac947765afe0a70181.dll
Size

1.4MB
MD5

7f28f980480d1a1e17850e38ba8748fb
SHA1

175389eed193cae3eb22a0ed7bfb570ef80d1f1f
SHA256

4a1b6cfd5bd497571f88e2cbf302d5d5ccc29f5939950bac947765afe0a70181
SHA512

e1ef647b26d2f422dbbc687245911ffc88056483416b0e630bab04248473eb402ef83b1c7cfc6c3cd6a280914148a66a89979470148d6205af76c3d0c5356af0
SSDEEP

24576:r9NGBZXQQQQQQQzriv9ETf7DAaJegK+3G8:r9NmXQQQQQQQzriv9CXY8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2600	1956	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 1956	1340	rundll32.exe	28
PID 1340 wrote to memory of 1956	1340	rundll32.exe	28
PID 1340 wrote to memory of 1956	1340	rundll32.exe	28
PID 1340 wrote to memory of 1956	1340	rundll32.exe	28
PID 1340 wrote to memory of 1956	1340	rundll32.exe	28
PID 1340 wrote to memory of 1956	1340	rundll32.exe	28
PID 1340 wrote to memory of 1956	1340	rundll32.exe	28
PID 1956 wrote to memory of 2600	1956	rundll32.exe	29
PID 1956 wrote to memory of 2600	1956	rundll32.exe	29
PID 1956 wrote to memory of 2600	1956	rundll32.exe	29
PID 1956 wrote to memory of 2600	1956	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a1b6cfd5bd497571f88e2cbf302d5d5ccc29f5939950bac947765afe0a70181.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a1b6cfd5bd497571f88e2cbf302d5d5ccc29f5939950bac947765afe0a70181.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 236
    3⤵
    - Program crash
    PID:2600

memory/1956-54-0x0000000074240000-0x00000000743AB000-memory.dmp

Filesize
1.4MB

Download