1d0128fd3184a765076397dd308e51bbc578a3639cb9c08ab6b5c36704d772b4

Resubmissions

14-11-2023 17:31

14-11-2023 17:21

28-10-2023 19:29

24-10-2023 13:29

18-10-2023 12:04

07-09-2023 12:10

max time kernel
15s
max time network
19s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07-09-2023 12:10

Target

1efeb078625478129da10c0e62b0c842e54286312fbb55c38187bda4d78974bb.dll
Size

44KB
MD5

aedfa7bf1c0e71e0fc136df7a94c0e50
SHA1

b4c51c6f5d161e9cb4752883e49fa1ebebbd6459
SHA256

1efeb078625478129da10c0e62b0c842e54286312fbb55c38187bda4d78974bb
SHA512

72c2f76d73f3e10d0aa761eabed5ad6e1e072991cdb3537719b8833c446a405946cb98cee9858774451d291b1fe00db287830367ff31b0e128bce4b12f8e2684
SSDEEP

768:Iq1MYKFDoccJ7dn8CXvTgyV6J+q6MXCNYKkvPUDrIdwI/CwRoKhG3m+wJoK+:IqeFkcE7dntfTdu+pcSkkD0bqwRTwPwO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2356	2976	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2976	2980	rundll32.exe	28
PID 2980 wrote to memory of 2976	2980	rundll32.exe	28
PID 2980 wrote to memory of 2976	2980	rundll32.exe	28
PID 2980 wrote to memory of 2976	2980	rundll32.exe	28
PID 2980 wrote to memory of 2976	2980	rundll32.exe	28
PID 2980 wrote to memory of 2976	2980	rundll32.exe	28
PID 2980 wrote to memory of 2976	2980	rundll32.exe	28
PID 2976 wrote to memory of 2356	2976	rundll32.exe	29
PID 2976 wrote to memory of 2356	2976	rundll32.exe	29
PID 2976 wrote to memory of 2356	2976	rundll32.exe	29
PID 2976 wrote to memory of 2356	2976	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1efeb078625478129da10c0e62b0c842e54286312fbb55c38187bda4d78974bb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1efeb078625478129da10c0e62b0c842e54286312fbb55c38187bda4d78974bb.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 272
    3⤵
    - Program crash
    PID:2356

memory/2976-1-0x00000000006C0000-0x000000000076C000-memory.dmp

Filesize
688KB

Download
memory/2976-2-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download
memory/2976-0-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download
memory/2976-3-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download
memory/2976-4-0x0000000000160000-0x0000000000162000-memory.dmp

Filesize
8KB

Download
memory/2976-5-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download
memory/2976-6-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download
memory/2976-8-0x0000000000160000-0x0000000000162000-memory.dmp

Filesize
8KB

Download