1dc94def4961bb0588f4215d20fed2c50e72311139642d977f0c099ed7155d18

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
06/10/2023, 01:52

Target

d72af640b71b8e3eca3eba660dd7c7f029ff8852bcacaa379e7b6c57cf4d9b44.dll
Size

855KB
MD5

8d18fea5750aede09464bbbd7c0df6a6
SHA1

6b18625f114ac1201f16e3fd2e9131a0406062e9
SHA256

d72af640b71b8e3eca3eba660dd7c7f029ff8852bcacaa379e7b6c57cf4d9b44
SHA512

237ac4d7331cabc8fd0b5309bf293e78ad0887783a173374406516e196a2cab7b656067ffccf19deca19aa2e46304738cb61195e0d6286e3bad7c1203fdf0620
SSDEEP

24576:57UuAhS4VYKBOSR45LlxAh/uSLKAlr/A/cYV5fN:A/YVSulxb1AlurF

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2244	2096	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2096	2936	rundll32.exe	28
PID 2936 wrote to memory of 2096	2936	rundll32.exe	28
PID 2936 wrote to memory of 2096	2936	rundll32.exe	28
PID 2936 wrote to memory of 2096	2936	rundll32.exe	28
PID 2936 wrote to memory of 2096	2936	rundll32.exe	28
PID 2936 wrote to memory of 2096	2936	rundll32.exe	28
PID 2936 wrote to memory of 2096	2936	rundll32.exe	28
PID 2096 wrote to memory of 2244	2096	rundll32.exe	29
PID 2096 wrote to memory of 2244	2096	rundll32.exe	29
PID 2096 wrote to memory of 2244	2096	rundll32.exe	29
PID 2096 wrote to memory of 2244	2096	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d72af640b71b8e3eca3eba660dd7c7f029ff8852bcacaa379e7b6c57cf4d9b44.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d72af640b71b8e3eca3eba660dd7c7f029ff8852bcacaa379e7b6c57cf4d9b44.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 224
    3⤵
    - Program crash
    PID:2244