b9fbab43cf6944ee904ae24d3d0bc877491970bf1f9ee734856a1784314c9b72

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
25/08/2023, 14:28

Target

b9fbab43cf6944ee904ae24d3d0bc877491970bf1f9ee734856a1784314c9b72.dll
Size

2.0MB
MD5

d47accab1eb22a0fb44ff3668ed547ef
SHA1

21a54949d24a629fb9c5f905a53ceab55f6ea570
SHA256

b9fbab43cf6944ee904ae24d3d0bc877491970bf1f9ee734856a1784314c9b72
SHA512

451e763aacf08ccabaabcf8505112cb9e6070573c668c875dc1dcd32ebde00627af87f8cbd495587637053d79d76604e62047feab470cc836ad86fb87d21a763
SSDEEP

49152:OF5AF8sbtuIHL2foYei/H7CeeRgKBhG6KBnTYnG5wwc+DZyJAEfB6Q7:uS8sbtukyfAi/H7Ce8LJKBnTYnG5wwcQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2420	2820	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2820	2912	rundll32.exe	28
PID 2912 wrote to memory of 2820	2912	rundll32.exe	28
PID 2912 wrote to memory of 2820	2912	rundll32.exe	28
PID 2912 wrote to memory of 2820	2912	rundll32.exe	28
PID 2912 wrote to memory of 2820	2912	rundll32.exe	28
PID 2912 wrote to memory of 2820	2912	rundll32.exe	28
PID 2912 wrote to memory of 2820	2912	rundll32.exe	28
PID 2820 wrote to memory of 2420	2820	rundll32.exe	29
PID 2820 wrote to memory of 2420	2820	rundll32.exe	29
PID 2820 wrote to memory of 2420	2820	rundll32.exe	29
PID 2820 wrote to memory of 2420	2820	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9fbab43cf6944ee904ae24d3d0bc877491970bf1f9ee734856a1784314c9b72.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9fbab43cf6944ee904ae24d3d0bc877491970bf1f9ee734856a1784314c9b72.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 240
    3⤵
    - Program crash
    PID:2420