a1a90cf9ef290e6a6e230535bab529ac59745e256b3b737c885a727be1d0d5ed

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
24-09-2023 02:26

Target

a1a90cf9ef290e6a6e230535bab529ac59745e256b3b737c885a727be1d0d5ed.dll
Size

208KB
MD5

9f79ee0aa51cb50eb2d84d745fe50fef
SHA1

d35ddef80b9d43609cd560475e05eb233fbd4c4f
SHA256

a1a90cf9ef290e6a6e230535bab529ac59745e256b3b737c885a727be1d0d5ed
SHA512

0a9d66d766050f5fcfa46d63f8775c04572fb5802e8255a25ee205dbaade26e7d9a483c4f4b262a5f56a760592159eca80fcc8a2d2c86e4ccac90b387ecac50f
SSDEEP

3072:LI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdU8Y5Y:LIDff9D8C6XYRw6MT2DEj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3064 2768 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3064	2768	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2088 wrote to memory of 2768	2088	rundll32.exe	rundll32.exe
PID 2088 wrote to memory of 2768	2088	rundll32.exe	rundll32.exe
PID 2088 wrote to memory of 2768	2088	rundll32.exe	rundll32.exe
PID 2088 wrote to memory of 2768	2088	rundll32.exe	rundll32.exe
PID 2088 wrote to memory of 2768	2088	rundll32.exe	rundll32.exe
PID 2088 wrote to memory of 2768	2088	rundll32.exe	rundll32.exe
PID 2088 wrote to memory of 2768	2088	rundll32.exe	rundll32.exe
PID 2768 wrote to memory of 3064	2768	rundll32.exe	WerFault.exe
PID 2768 wrote to memory of 3064	2768	rundll32.exe	WerFault.exe
PID 2768 wrote to memory of 3064	2768	rundll32.exe	WerFault.exe
PID 2768 wrote to memory of 3064	2768	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1a90cf9ef290e6a6e230535bab529ac59745e256b3b737c885a727be1d0d5ed.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2088

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1a90cf9ef290e6a6e230535bab529ac59745e256b3b737c885a727be1d0d5ed.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 232
3⤵
- Program crash
PID:3064