ad651fcc79e346a5026b3aa5bce00dc053a45ec08be1f318eb00e93f7a02ad3f

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
01/09/2023, 09:20

Target

JOYRP | ФАЙЛЫ/server_connect.dll
Size

14KB
MD5

39363881de66b773970a8c24afd6ae76
SHA1

c26f6d89049626fb2b4434466c191b257e7d9cb5
SHA256

d286c8e0fcd3eed16e6c28e89b2304fb791cce4d15f8136e41a6be062f97349f
SHA512

288e25894056aef14a1b817c5fc2640cae77f6eda383d07890611d0d04db00dd66e6e4f7c9027e68da7a1b9b2e89631806bb473e4b9764a6fdfeadd46acffeef
SSDEEP

192:HSMznoKZRtgf7cavdiCXpsXcVUO6hWJmI1jOb82e/4JabtVjhr3TJoDPEBUEYIG3:HXnoKDm7cUdFwEJmUj4GdKgBNYIG3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1704	1916	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 1916	2240	rundll32.exe	28
PID 2240 wrote to memory of 1916	2240	rundll32.exe	28
PID 2240 wrote to memory of 1916	2240	rundll32.exe	28
PID 2240 wrote to memory of 1916	2240	rundll32.exe	28
PID 2240 wrote to memory of 1916	2240	rundll32.exe	28
PID 2240 wrote to memory of 1916	2240	rundll32.exe	28
PID 2240 wrote to memory of 1916	2240	rundll32.exe	28
PID 1916 wrote to memory of 1704	1916	rundll32.exe	29
PID 1916 wrote to memory of 1704	1916	rundll32.exe	29
PID 1916 wrote to memory of 1704	1916	rundll32.exe	29
PID 1916 wrote to memory of 1704	1916	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\JOYRP _ ФАЙЛЫ\server_connect.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\JOYRP _ ФАЙЛЫ\server_connect.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 216
    3⤵
    - Program crash
    PID:1704