020852ac13c272d2033bb12acc67838d417a620bdebc8153c8aa32d82b24efc3

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
29-09-2023 02:26

Target

020852ac13c272d2033bb12acc67838d417a620bdebc8153c8aa32d82b24efc3.dll
Size

208KB
MD5

6f8e32c572cdef46e506a1577f3cc752
SHA1

bee22a9384e1623310e027be6eab2d9781ac5966
SHA256

020852ac13c272d2033bb12acc67838d417a620bdebc8153c8aa32d82b24efc3
SHA512

1f19280e91433130d5845c312a76944aa99ee28da4fe7580f6e3d5b8b62c5377b019242dff60aaa6375b701c9579ee4e1dde53b6e468b3ca3ad7d631297b2f9d
SSDEEP

3072:aI6CqRCxffkClDn7LQlRw6x+Y3CxT2DtK5jdUfY5w:aIDff9NXYRw6MT2DEj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3068 2320 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3068	2320	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2292 wrote to memory of 2320	2292	rundll32.exe	rundll32.exe
PID 2292 wrote to memory of 2320	2292	rundll32.exe	rundll32.exe
PID 2292 wrote to memory of 2320	2292	rundll32.exe	rundll32.exe
PID 2292 wrote to memory of 2320	2292	rundll32.exe	rundll32.exe
PID 2292 wrote to memory of 2320	2292	rundll32.exe	rundll32.exe
PID 2292 wrote to memory of 2320	2292	rundll32.exe	rundll32.exe
PID 2292 wrote to memory of 2320	2292	rundll32.exe	rundll32.exe
PID 2320 wrote to memory of 3068	2320	rundll32.exe	WerFault.exe
PID 2320 wrote to memory of 3068	2320	rundll32.exe	WerFault.exe
PID 2320 wrote to memory of 3068	2320	rundll32.exe	WerFault.exe
PID 2320 wrote to memory of 3068	2320	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\020852ac13c272d2033bb12acc67838d417a620bdebc8153c8aa32d82b24efc3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2292

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\020852ac13c272d2033bb12acc67838d417a620bdebc8153c8aa32d82b24efc3.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 232
3⤵
- Program crash
PID:3068