5489b800678c1a53773aac465b47514f1fc3f4dd71937a4e2983841585c53bdc

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
17-09-2023 14:16

Target

5489b800678c1a53773aac465b47514f1fc3f4dd71937a4e2983841585c53bdc.dll
Size

218KB
MD5

74310419023423e04ee5212d5cb5c9c3
SHA1

e35cf69cb8c9540621d91ea6274a037a160983cb
SHA256

5489b800678c1a53773aac465b47514f1fc3f4dd71937a4e2983841585c53bdc
SHA512

0e3c38bf545170ebfcc3c5d31cee314e2d757d97a5ab43b5d4b8c782d59fedb11379f9243f1aba76489e75c30881aa0425a0e4d9f3084956b57255f5c927e90c
SSDEEP

3072:4fyTFpiSc43UtiD8Umh8I6lk0bF+EjJeNDU2a7i78nifiRjdUw5cWBS:4flD4ktiD8UI8I66C+6AsXnifujF

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2112 2028 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2112	2028	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2192 wrote to memory of 2028	2192	rundll32.exe	rundll32.exe
PID 2192 wrote to memory of 2028	2192	rundll32.exe	rundll32.exe
PID 2192 wrote to memory of 2028	2192	rundll32.exe	rundll32.exe
PID 2192 wrote to memory of 2028	2192	rundll32.exe	rundll32.exe
PID 2192 wrote to memory of 2028	2192	rundll32.exe	rundll32.exe
PID 2192 wrote to memory of 2028	2192	rundll32.exe	rundll32.exe
PID 2192 wrote to memory of 2028	2192	rundll32.exe	rundll32.exe
PID 2028 wrote to memory of 2112	2028	rundll32.exe	WerFault.exe
PID 2028 wrote to memory of 2112	2028	rundll32.exe	WerFault.exe
PID 2028 wrote to memory of 2112	2028	rundll32.exe	WerFault.exe
PID 2028 wrote to memory of 2112	2028	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5489b800678c1a53773aac465b47514f1fc3f4dd71937a4e2983841585c53bdc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2192

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5489b800678c1a53773aac465b47514f1fc3f4dd71937a4e2983841585c53bdc.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 232
3⤵
- Program crash
PID:2112