0b5ad207f3aeeb699ed22f247c84d8dbcb5b27af247e72bab13cebd6b96ebc99

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
22/09/2023, 05:15

Target

0b5ad207f3aeeb699ed22f247c84d8dbcb5b27af247e72bab13cebd6b96ebc99.dll
Size

5.3MB
MD5

328922ab1ab022453413be43c738a931
SHA1

442f5fa386252bdb47b25ec0324880d5236212ca
SHA256

0b5ad207f3aeeb699ed22f247c84d8dbcb5b27af247e72bab13cebd6b96ebc99
SHA512

e62e88399f025b1f6d88d5ed091a77af90a708ddb71a601a03c752139c7d4e2b98f8a6cece6c736c61d14a9402201aabf377064a7bb4350e01fafef5a74b9b52
SSDEEP

49152:gHQOgglgOSqLRwNPSRVFm7SmkQCHSaibEZDT+UYSTxEIDdABpljRW0a+aH7JxzSx:gHKPl4ax2nIEZTORQD

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2204	2188	WerFault.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2188	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2188	2012	rundll32.exe	28
PID 2012 wrote to memory of 2188	2012	rundll32.exe	28
PID 2012 wrote to memory of 2188	2012	rundll32.exe	28
PID 2012 wrote to memory of 2188	2012	rundll32.exe	28
PID 2012 wrote to memory of 2188	2012	rundll32.exe	28
PID 2012 wrote to memory of 2188	2012	rundll32.exe	28
PID 2012 wrote to memory of 2188	2012	rundll32.exe	28
PID 2188 wrote to memory of 2204	2188	rundll32.exe	29
PID 2188 wrote to memory of 2204	2188	rundll32.exe	29
PID 2188 wrote to memory of 2204	2188	rundll32.exe	29
PID 2188 wrote to memory of 2204	2188	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b5ad207f3aeeb699ed22f247c84d8dbcb5b27af247e72bab13cebd6b96ebc99.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b5ad207f3aeeb699ed22f247c84d8dbcb5b27af247e72bab13cebd6b96ebc99.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 288
    3⤵
    - Program crash
    PID:2204

memory/2188-0-0x0000000073EF0000-0x0000000074464000-memory.dmp

Filesize
5.5MB

Download