319694c6d3edda2705d52641d2b1d15933a2d06dadd1c87c8f14f223f193a1dd

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
27-08-2023 23:08

Target

319694c6d3edda2705d52641d2b1d15933a2d06dadd1c87c8f14f223f193a1dd.dll
Size

208KB
MD5

efd7465d29fe7520dd92f516111d1c54
SHA1

62187d2c815e6066ebdc608dc18d969d08a9e750
SHA256

319694c6d3edda2705d52641d2b1d15933a2d06dadd1c87c8f14f223f193a1dd
SHA512

5ae1c34c9132b9489f15d88b45c522415387e5628d6a1f25e06f563decdd93d6328b299d7ce4e4910c6eee7cf661ee38dd5bc1cfc32a6e855179522174b80146
SSDEEP

3072:LI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdUIY5j:LIDff9D8C6XYRw6MT2DEj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1476 1672 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1476	1672	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 748 wrote to memory of 1672	748	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 1672	748	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 1672	748	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 1672	748	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 1672	748	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 1672	748	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 1672	748	rundll32.exe	rundll32.exe
PID 1672 wrote to memory of 1476	1672	rundll32.exe	WerFault.exe
PID 1672 wrote to memory of 1476	1672	rundll32.exe	WerFault.exe
PID 1672 wrote to memory of 1476	1672	rundll32.exe	WerFault.exe
PID 1672 wrote to memory of 1476	1672	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\319694c6d3edda2705d52641d2b1d15933a2d06dadd1c87c8f14f223f193a1dd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:748

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\319694c6d3edda2705d52641d2b1d15933a2d06dadd1c87c8f14f223f193a1dd.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 232
3⤵
- Program crash
PID:1476