fadc55c44d59d25924d1d68c810ff63d0910308a8eca7e5cb58978d8778e80c5

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
24-08-2023 04:40

Target

fadc55c44d59d25924d1d68c810ff63d0910308a8eca7e5cb58978d8778e80c5.dll
Size

2.0MB
MD5

b6f0992934abeed43a9a2aae4b7cf85e
SHA1

e6f3378919bc311255ea0cb38e13764280b3b6d2
SHA256

fadc55c44d59d25924d1d68c810ff63d0910308a8eca7e5cb58978d8778e80c5
SHA512

4d303368716e59e7bde45f54795c078974d380e7aa9366e4b5a5409bb476e52b1826fb63c5d9fe5fd039cbe38929f281d2638ca287a2e10d20699582b3372f27
SSDEEP

49152:SpW2WCN9mIFOKjQ5TwRonUr1q7NWcPjHvhxbC5GMhE:SpW2WCDmIFOh5Twzq7NWsPh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2644	2640	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 2640	952	rundll32.exe	28
PID 952 wrote to memory of 2640	952	rundll32.exe	28
PID 952 wrote to memory of 2640	952	rundll32.exe	28
PID 952 wrote to memory of 2640	952	rundll32.exe	28
PID 952 wrote to memory of 2640	952	rundll32.exe	28
PID 952 wrote to memory of 2640	952	rundll32.exe	28
PID 952 wrote to memory of 2640	952	rundll32.exe	28
PID 2640 wrote to memory of 2644	2640	rundll32.exe	31
PID 2640 wrote to memory of 2644	2640	rundll32.exe	31
PID 2640 wrote to memory of 2644	2640	rundll32.exe	31
PID 2640 wrote to memory of 2644	2640	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fadc55c44d59d25924d1d68c810ff63d0910308a8eca7e5cb58978d8778e80c5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fadc55c44d59d25924d1d68c810ff63d0910308a8eca7e5cb58978d8778e80c5.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 268
    3⤵
    - Program crash
    PID:2644