f8fb77fa36d9a87006bc39665b450e790e5927df9570058ad9f39d581bd84477

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
26-08-2023 02:04

Target

04078d8fc713e5738d13615561303bbdec7c64c9a4b72e12db549d42ee7776ec.dll
Size

9.3MB
MD5

fa27b9312d5064df5ec193ba0292334b
SHA1

e3c668c2fae47994407e8442f2dafad2b5faca03
SHA256

04078d8fc713e5738d13615561303bbdec7c64c9a4b72e12db549d42ee7776ec
SHA512

96376694445cf7aed17f4fc78afe8ac969cccb915dcf134fa35cc433e26a8f4442f82a3ae1908e121f26e2257f049005f8d259f275dbb4c33a5c263fe86f876f
SSDEEP

49152:GCZNlQ+EsEf7JWG5T+xFSUbwhx/2QE4ftat3/KsnWsm9cVIrU8+c73cIU0XcJCns:GCZN9d44WsOmucBqI/0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2520	2076	WerFault.exe	23

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2520	2076	rundll32.exe	28
PID 2076 wrote to memory of 2520	2076	rundll32.exe	28
PID 2076 wrote to memory of 2520	2076	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\04078d8fc713e5738d13615561303bbdec7c64c9a4b72e12db549d42ee7776ec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2076 -s 248
  2⤵
  - Program crash
  PID:2520

memory/2076-0-0x0000000074210000-0x0000000074AC7000-memory.dmp

Filesize
8.7MB

Download