b6269018ac32484bdc093a6bec324fc9aa7990104a297f55600d31bff95ed6fd

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
04-10-2023 16:15

Target

i1v/zN/JI/eWJM/MVst/qI/1Q52/uURq/QIPJ/J4Xw/J6V/CO/bOs8/GMV/N53B/xSa.dll
Size

855KB
MD5

cf46f0cd591e50c425136470505e8a9e
SHA1

0e3d1488b9aa104aa0a39966132a70a47165aaef
SHA256

5a5154c5843a18d3912063b827ef541a709aec4132b847d75d7e634683acff8d
SHA512

3bddf5e233dbd8c4554c73050b0299892b7132afc1bdc67882daa309e0bf1767430aebade35977d06564f41477eeedb5840595cf2446e28d7d47d03179a1a5e4
SSDEEP

24576:v7UuAhS4VYKBOSR45LlxAh/uSLKAlr/A/cYV5fN:6/YVSulxb1AlurF

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1872	2440	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2440	2232	rundll32.exe	28
PID 2232 wrote to memory of 2440	2232	rundll32.exe	28
PID 2232 wrote to memory of 2440	2232	rundll32.exe	28
PID 2232 wrote to memory of 2440	2232	rundll32.exe	28
PID 2232 wrote to memory of 2440	2232	rundll32.exe	28
PID 2232 wrote to memory of 2440	2232	rundll32.exe	28
PID 2232 wrote to memory of 2440	2232	rundll32.exe	28
PID 2440 wrote to memory of 1872	2440	rundll32.exe	29
PID 2440 wrote to memory of 1872	2440	rundll32.exe	29
PID 2440 wrote to memory of 1872	2440	rundll32.exe	29
PID 2440 wrote to memory of 1872	2440	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\i1v\zN\JI\eWJM\MVst\qI\1Q52\uURq\QIPJ\J4Xw\J6V\CO\bOs8\GMV\N53B\xSa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\i1v\zN\JI\eWJM\MVst\qI\1Q52\uURq\QIPJ\J4Xw\J6V\CO\bOs8\GMV\N53B\xSa.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 224
    3⤵
    - Program crash
    PID:1872