f83eed19b381a656d5765e4da64337d234293663764ba442632170d178c5be45

Analysis

max time kernel
141s
max time network
121s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
30/08/2023, 23:16

Target

f83eed19b381a656d5765e4da64337d234293663764ba442632170d178c5be45.dll
Size

140KB
MD5

c14c19bffb613db3a83ead5ca9d2db9f
SHA1

72f2c94780f6f26a0ff8c13efde47d14d60661e6
SHA256

f83eed19b381a656d5765e4da64337d234293663764ba442632170d178c5be45
SHA512

100e5592c0ac96e0d42a23168ad8ac354c2d1618136484254adb3a94e95fec589a3651525eaa081444113070b721aacf20e4267f39acad443913ac4f226a3a53
SSDEEP

3072:xd3b3cGM1R8GhWyDSWfsUQzxwGevZqgAbBdlaJb:xxH2WEftQdSZqgAzlOb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2404	1952	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 1952	844	rundll32.exe	28
PID 844 wrote to memory of 1952	844	rundll32.exe	28
PID 844 wrote to memory of 1952	844	rundll32.exe	28
PID 844 wrote to memory of 1952	844	rundll32.exe	28
PID 844 wrote to memory of 1952	844	rundll32.exe	28
PID 844 wrote to memory of 1952	844	rundll32.exe	28
PID 844 wrote to memory of 1952	844	rundll32.exe	28
PID 1952 wrote to memory of 2404	1952	rundll32.exe	29
PID 1952 wrote to memory of 2404	1952	rundll32.exe	29
PID 1952 wrote to memory of 2404	1952	rundll32.exe	29
PID 1952 wrote to memory of 2404	1952	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f83eed19b381a656d5765e4da64337d234293663764ba442632170d178c5be45.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f83eed19b381a656d5765e4da64337d234293663764ba442632170d178c5be45.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 244
    3⤵
    - Program crash
    PID:2404

memory/1952-0-0x000000007ABD0000-0x000000007ABFC000-memory.dmp

Filesize
176KB

Download