0ee170eb92a1063c45512e55aa2c4c7e40e58e1cdc77ce13b5fe56163b871531

Analysis

max time kernel
291s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
01-10-2023 09:07

Target

qnr.dll
Size

455KB
MD5

d29c850c3b5820060316176c1786c5cc
SHA1

c86dab1668b1a13ec8901db146d44f034eedf05e
SHA256

641a7339c2000604dc8f425383e9c34b1b117f647e40e1786838828a2552d27c
SHA512

cf4c8a9544fd2a2a4ddc4b00118508315f809bc2efb28c7526e951f498e349f3593e777332df960f41eca2d7600335f81c8607e5159079f8a50b8b83644e77a4
SSDEEP

12288:GowmOwSqB7wGo/DzEOdg64dBBVIDL1jRQ+sc6r:kP96w3/Dzd2VI9jGpc6r

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2072 2212 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2072	2212	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2184 wrote to memory of 2212	2184	rundll32.exe	rundll32.exe
PID 2184 wrote to memory of 2212	2184	rundll32.exe	rundll32.exe
PID 2184 wrote to memory of 2212	2184	rundll32.exe	rundll32.exe
PID 2184 wrote to memory of 2212	2184	rundll32.exe	rundll32.exe
PID 2184 wrote to memory of 2212	2184	rundll32.exe	rundll32.exe
PID 2184 wrote to memory of 2212	2184	rundll32.exe	rundll32.exe
PID 2184 wrote to memory of 2212	2184	rundll32.exe	rundll32.exe
PID 2212 wrote to memory of 2072	2212	rundll32.exe	WerFault.exe
PID 2212 wrote to memory of 2072	2212	rundll32.exe	WerFault.exe
PID 2212 wrote to memory of 2072	2212	rundll32.exe	WerFault.exe
PID 2212 wrote to memory of 2072	2212	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\qnr.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2184

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\qnr.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 260
3⤵
- Program crash
PID:2072

memory/2212-1-0x0000000074850000-0x00000000749DA000-memory.dmp

Filesize
1.5MB

Download
memory/2212-3-0x0000000074840000-0x00000000749CA000-memory.dmp

Filesize
1.5MB

Download
memory/2212-5-0x0000000074860000-0x00000000749EA000-memory.dmp

Filesize
1.5MB

Download
memory/2212-7-0x0000000074860000-0x00000000749EA000-memory.dmp

Filesize
1.5MB

Download
memory/2212-8-0x0000000074860000-0x00000000749EA000-memory.dmp

Filesize
1.5MB

Download
memory/2212-2-0x0000000074860000-0x00000000749EA000-memory.dmp

Filesize
1.5MB

Download
memory/2212-0-0x0000000074860000-0x00000000749EA000-memory.dmp

Filesize
1.5MB

Download
memory/2212-9-0x000000007738F000-0x0000000077390000-memory.dmp

Filesize
4KB

Download
memory/2212-10-0x0000000076A30000-0x0000000076B40000-memory.dmp

Filesize
1.1MB

Download
memory/2212-11-0x0000000074860000-0x00000000749EA000-memory.dmp

Filesize
1.5MB

Download
memory/2212-13-0x0000000076A30000-0x0000000076B40000-memory.dmp

Filesize
1.1MB

Download