0ee170eb92a1063c45512e55aa2c4c7e40e58e1cdc77ce13b5fe56163b871531

Analysis

max time kernel
291s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
01-10-2023 09:07

Target

qnr.dll
Size

455KB
MD5

d29c850c3b5820060316176c1786c5cc
SHA1

c86dab1668b1a13ec8901db146d44f034eedf05e
SHA256

641a7339c2000604dc8f425383e9c34b1b117f647e40e1786838828a2552d27c
SHA512

cf4c8a9544fd2a2a4ddc4b00118508315f809bc2efb28c7526e951f498e349f3593e777332df960f41eca2d7600335f81c8607e5159079f8a50b8b83644e77a4
SSDEEP

12288:GowmOwSqB7wGo/DzEOdg64dBBVIDL1jRQ+sc6r:kP96w3/Dzd2VI9jGpc6r

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2072	2212	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2212	2184	rundll32.exe	28
PID 2184 wrote to memory of 2212	2184	rundll32.exe	28
PID 2184 wrote to memory of 2212	2184	rundll32.exe	28
PID 2184 wrote to memory of 2212	2184	rundll32.exe	28
PID 2184 wrote to memory of 2212	2184	rundll32.exe	28
PID 2184 wrote to memory of 2212	2184	rundll32.exe	28
PID 2184 wrote to memory of 2212	2184	rundll32.exe	28
PID 2212 wrote to memory of 2072	2212	rundll32.exe	29
PID 2212 wrote to memory of 2072	2212	rundll32.exe	29
PID 2212 wrote to memory of 2072	2212	rundll32.exe	29
PID 2212 wrote to memory of 2072	2212	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\qnr.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\qnr.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 260
    3⤵
    - Program crash
    PID:2072

memory/2212-1-0x0000000074850000-0x00000000749DA000-memory.dmp

Filesize
1.5MB

Download
memory/2212-3-0x0000000074840000-0x00000000749CA000-memory.dmp

Filesize
1.5MB

Download
memory/2212-5-0x0000000074860000-0x00000000749EA000-memory.dmp

Filesize
1.5MB

Download
memory/2212-7-0x0000000074860000-0x00000000749EA000-memory.dmp

Filesize
1.5MB

Download
memory/2212-8-0x0000000074860000-0x00000000749EA000-memory.dmp

Filesize
1.5MB

Download
memory/2212-2-0x0000000074860000-0x00000000749EA000-memory.dmp

Filesize
1.5MB

Download
memory/2212-0-0x0000000074860000-0x00000000749EA000-memory.dmp

Filesize
1.5MB

Download
memory/2212-9-0x000000007738F000-0x0000000077390000-memory.dmp

Filesize
4KB

Download
memory/2212-10-0x0000000076A30000-0x0000000076B40000-memory.dmp

Filesize
1.1MB

Download
memory/2212-11-0x0000000074860000-0x00000000749EA000-memory.dmp

Filesize
1.5MB

Download
memory/2212-13-0x0000000076A30000-0x0000000076B40000-memory.dmp

Filesize
1.1MB

Download