27d56ff8547d6a2e93c0044f57d5c2d77ab7159becd12ac2a273c0b9c49f7848

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
24/08/2023, 22:38

Target

27d56ff8547d6a2e93c0044f57d5c2d77ab7159becd12ac2a273c0b9c49f7848.dll
Size

9.7MB
MD5

0b8bee90f401a332e26d15e88f70e7dd
SHA1

e6a39810b738294c9bcc2249a29ae91445f1390f
SHA256

27d56ff8547d6a2e93c0044f57d5c2d77ab7159becd12ac2a273c0b9c49f7848
SHA512

029fa6a81ba5103166cf3363804c9849520fee83247bd8596142d4da6b7816737d64d43f68744a4cfc6ce64a5ebe6998b964f4d4d1f2de75cd66a656b9fa25b9
SSDEEP

98304:uYmMCex+NVo8YMlg6/nO3AJLWypd9NXfeBnc69v0vMru22Z7aefEflQiYrYVo0j3:ypcXGnbLWU98tfd8tM2ik0vju3J8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1968	824	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
824	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 824	2212	rundll32.exe	28
PID 2212 wrote to memory of 824	2212	rundll32.exe	28
PID 2212 wrote to memory of 824	2212	rundll32.exe	28
PID 2212 wrote to memory of 824	2212	rundll32.exe	28
PID 2212 wrote to memory of 824	2212	rundll32.exe	28
PID 2212 wrote to memory of 824	2212	rundll32.exe	28
PID 2212 wrote to memory of 824	2212	rundll32.exe	28
PID 824 wrote to memory of 1968	824	rundll32.exe	29
PID 824 wrote to memory of 1968	824	rundll32.exe	29
PID 824 wrote to memory of 1968	824	rundll32.exe	29
PID 824 wrote to memory of 1968	824	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\27d56ff8547d6a2e93c0044f57d5c2d77ab7159becd12ac2a273c0b9c49f7848.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\27d56ff8547d6a2e93c0044f57d5c2d77ab7159becd12ac2a273c0b9c49f7848.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:824
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 824 -s 276
    3⤵
    - Program crash
    PID:1968