9ccd705289020653e333c408e37b7b44c73bc4ee56ca128b344b9d95f48aa22d

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
08-10-2023 21:45

Target

9ccd705289020653e333c408e37b7b44c73bc4ee56ca128b344b9d95f48aa22d.dll
Size

5.3MB
MD5

7662489b2216c9b5d3efc395a22d9c10
SHA1

a76829e9c7d2558c39705ef50d5d2a877f16d0b2
SHA256

9ccd705289020653e333c408e37b7b44c73bc4ee56ca128b344b9d95f48aa22d
SHA512

493691be8910b8ccf45c7a1cf745d2206426fbc0626fd68b9b2f4f4510688327d22b5a897587326d76201f7a94c6748272d5cc176b91cd019542fbae38d71d1f
SSDEEP

49152:fqQO5gl4W3RzpJNPSJtFuzSu0QCHqKq7NhDT+8Ylrqco+dgBpJNCW5a+aH7Jxz2x:fq/3k/XB2fgNKryCXD

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2940	1924	WerFault.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1924	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 1924	1404	rundll32.exe	28
PID 1404 wrote to memory of 1924	1404	rundll32.exe	28
PID 1404 wrote to memory of 1924	1404	rundll32.exe	28
PID 1404 wrote to memory of 1924	1404	rundll32.exe	28
PID 1404 wrote to memory of 1924	1404	rundll32.exe	28
PID 1404 wrote to memory of 1924	1404	rundll32.exe	28
PID 1404 wrote to memory of 1924	1404	rundll32.exe	28
PID 1924 wrote to memory of 2940	1924	rundll32.exe	29
PID 1924 wrote to memory of 2940	1924	rundll32.exe	29
PID 1924 wrote to memory of 2940	1924	rundll32.exe	29
PID 1924 wrote to memory of 2940	1924	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ccd705289020653e333c408e37b7b44c73bc4ee56ca128b344b9d95f48aa22d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ccd705289020653e333c408e37b7b44c73bc4ee56ca128b344b9d95f48aa22d.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 288
    3⤵
    - Program crash
    PID:2940

memory/1924-0-0x0000000074140000-0x00000000746B4000-memory.dmp

Filesize
5.5MB

Download