0b8605aa8d9df88d54ce3bd80c55752483cbd67c8958d04ebaa52950b20e8911

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14-09-2023 23:27

Target

0b8605aa8d9df88d54ce3bd80c55752483cbd67c8958d04ebaa52950b20e8911.dll
Size

208KB
MD5

a53ad99d76d6df2b3bc845409f5d4910
SHA1

976b782f0b9157134d5b4443e3ff1437a2cc8c55
SHA256

0b8605aa8d9df88d54ce3bd80c55752483cbd67c8958d04ebaa52950b20e8911
SHA512

9aac57958bc2b23f5e634e1310d8f3ac56d9eafdedc06a80a3ef23fa940f7b6d43cb1efa25157d654a68007690a0d3ab203e723f1630944a7da09aa0088b3605
SSDEEP

3072:cI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdUMPfY5g+v:cIDff9D8C6XYRw6MT2DEj/k

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1972 2792 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1972	2792	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1852 wrote to memory of 2792	1852	rundll32.exe	rundll32.exe
PID 1852 wrote to memory of 2792	1852	rundll32.exe	rundll32.exe
PID 1852 wrote to memory of 2792	1852	rundll32.exe	rundll32.exe
PID 1852 wrote to memory of 2792	1852	rundll32.exe	rundll32.exe
PID 1852 wrote to memory of 2792	1852	rundll32.exe	rundll32.exe
PID 1852 wrote to memory of 2792	1852	rundll32.exe	rundll32.exe
PID 1852 wrote to memory of 2792	1852	rundll32.exe	rundll32.exe
PID 2792 wrote to memory of 1972	2792	rundll32.exe	WerFault.exe
PID 2792 wrote to memory of 1972	2792	rundll32.exe	WerFault.exe
PID 2792 wrote to memory of 1972	2792	rundll32.exe	WerFault.exe
PID 2792 wrote to memory of 1972	2792	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b8605aa8d9df88d54ce3bd80c55752483cbd67c8958d04ebaa52950b20e8911.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1852

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b8605aa8d9df88d54ce3bd80c55752483cbd67c8958d04ebaa52950b20e8911.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2792 -s 232
3⤵
- Program crash
PID:1972