dfe88cfaf64dd5a239f28f18171e4e5ad5f2d5429f3b2f3af7471296ab178fcd

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
29-08-2023 12:23

Target

dfe88cfaf64dd5a239f28f18171e4e5ad5f2d5429f3b2f3af7471296ab178fcd.dll
Size

208KB
MD5

4e49f49ce8f4e45fe371a95945ae1464
SHA1

0b96e861a3a5f56b3c224fb80042ebe1a8caa1b8
SHA256

dfe88cfaf64dd5a239f28f18171e4e5ad5f2d5429f3b2f3af7471296ab178fcd
SHA512

07c9c6e3c0d834323b80943e7b6c8db61a6099e04de7a16646af242154426df365a3a47949e22bc6950fc17b994ba57dd43738812013010074dd5a7770a76eda
SSDEEP

3072:LI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdUFvY5r:LIDff9D8C6XYRw6MT2DEj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2392 2996 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2392	2996	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2524 wrote to memory of 2996	2524	rundll32.exe	rundll32.exe
PID 2524 wrote to memory of 2996	2524	rundll32.exe	rundll32.exe
PID 2524 wrote to memory of 2996	2524	rundll32.exe	rundll32.exe
PID 2524 wrote to memory of 2996	2524	rundll32.exe	rundll32.exe
PID 2524 wrote to memory of 2996	2524	rundll32.exe	rundll32.exe
PID 2524 wrote to memory of 2996	2524	rundll32.exe	rundll32.exe
PID 2524 wrote to memory of 2996	2524	rundll32.exe	rundll32.exe
PID 2996 wrote to memory of 2392	2996	rundll32.exe	WerFault.exe
PID 2996 wrote to memory of 2392	2996	rundll32.exe	WerFault.exe
PID 2996 wrote to memory of 2392	2996	rundll32.exe	WerFault.exe
PID 2996 wrote to memory of 2392	2996	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dfe88cfaf64dd5a239f28f18171e4e5ad5f2d5429f3b2f3af7471296ab178fcd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2524

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dfe88cfaf64dd5a239f28f18171e4e5ad5f2d5429f3b2f3af7471296ab178fcd.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 232
3⤵
- Program crash
PID:2392