f7ef943775334a5a15a925f35584cf18d55ccca4fa2c90df1e58a613d84c973b

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
22-09-2023 17:57

Target

f7ef943775334a5a15a925f35584cf18d55ccca4fa2c90df1e58a613d84c973b.dll
Size

208KB
MD5

6495489f64dce65a99c1cc567a539e8b
SHA1

43cda2925453c964ed4d8a71e574b81fd6af4b26
SHA256

f7ef943775334a5a15a925f35584cf18d55ccca4fa2c90df1e58a613d84c973b
SHA512

19e1eb7cb631fa64fcd4cc54692944b9311e2a178434d8cd5ce98027374ceed9c4154c5ab3683a38446564b81e66322f6ee8c3b01dbd6ec473dff2a9e44b1a22
SSDEEP

3072:LI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdUbY50:LIDff9D8C6XYRw6MT2DEj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2880 1100 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2880	1100	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2068 wrote to memory of 1100	2068	rundll32.exe	rundll32.exe
PID 2068 wrote to memory of 1100	2068	rundll32.exe	rundll32.exe
PID 2068 wrote to memory of 1100	2068	rundll32.exe	rundll32.exe
PID 2068 wrote to memory of 1100	2068	rundll32.exe	rundll32.exe
PID 2068 wrote to memory of 1100	2068	rundll32.exe	rundll32.exe
PID 2068 wrote to memory of 1100	2068	rundll32.exe	rundll32.exe
PID 2068 wrote to memory of 1100	2068	rundll32.exe	rundll32.exe
PID 1100 wrote to memory of 2880	1100	rundll32.exe	WerFault.exe
PID 1100 wrote to memory of 2880	1100	rundll32.exe	WerFault.exe
PID 1100 wrote to memory of 2880	1100	rundll32.exe	WerFault.exe
PID 1100 wrote to memory of 2880	1100	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7ef943775334a5a15a925f35584cf18d55ccca4fa2c90df1e58a613d84c973b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2068

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7ef943775334a5a15a925f35584cf18d55ccca4fa2c90df1e58a613d84c973b.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 232
3⤵
- Program crash
PID:2880