c80e17b0d39d12b337ef491223f63057b91bf015a9029fd143e6bb9f6632f51f

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
02-09-2023 18:22

Target

c80e17b0d39d12b337ef491223f63057b91bf015a9029fd143e6bb9f6632f51f.dll
Size

13KB
MD5

caaf55c2c91c9539c6e3ff88354801bb
SHA1

660e2f59809717b7dc522e87f2468d9969a4bc0d
SHA256

c80e17b0d39d12b337ef491223f63057b91bf015a9029fd143e6bb9f6632f51f
SHA512

1895abf68a07ab4a26da3f493a8e7f9c54e2bfe7b10749e069e3f547bd44a86bbba29df731edf6c6581e1d4e10e69cbce35df50a15226fa84f23b0d604afe775
SSDEEP

192:Wftft4w/QjUXC6pIm5jZkP+9osfcwU/ZpYbR:mv/QgXZZkP+9o8tcp0R

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1668	2976	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 1668	2976	rundll32.exe	28
PID 2976 wrote to memory of 1668	2976	rundll32.exe	28
PID 2976 wrote to memory of 1668	2976	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c80e17b0d39d12b337ef491223f63057b91bf015a9029fd143e6bb9f6632f51f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2976 -s 84
  2⤵
  - Program crash
  PID:1668