5544a04db7c4d7565ba6385deba25e43c2cdc51bbc07491589941fa01de73c7f

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
09/10/2023, 12:23

Target

5544a04db7c4d7565ba6385deba25e43c2cdc51bbc07491589941fa01de73c7f.dll
Size

234KB
MD5

53f87c91979a1729090cec173858428a
SHA1

b52ae1401aff64ce1fbec9db48e258cf4e75dad2
SHA256

5544a04db7c4d7565ba6385deba25e43c2cdc51bbc07491589941fa01de73c7f
SHA512

b2b44bcdaaea060f0ce38d702746bb5a804ca89a142ee267dc8db9bc39064d3ea248b8b04f81cbb607049ef3c726582877416e90ba58416d3bcc3c810516ad1d
SSDEEP

3072:n3vli2EJv1RBuZH3JxgYhgipvLKoTte0SqoOCtA21/wlULGs7jnZdFjdUX/5Ja:n3vyJNRkZHBvZp0qoOCu2pkojnZHj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2948	1704	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 1704	2840	rundll32.exe	28
PID 2840 wrote to memory of 1704	2840	rundll32.exe	28
PID 2840 wrote to memory of 1704	2840	rundll32.exe	28
PID 2840 wrote to memory of 1704	2840	rundll32.exe	28
PID 2840 wrote to memory of 1704	2840	rundll32.exe	28
PID 2840 wrote to memory of 1704	2840	rundll32.exe	28
PID 2840 wrote to memory of 1704	2840	rundll32.exe	28
PID 1704 wrote to memory of 2948	1704	rundll32.exe	29
PID 1704 wrote to memory of 2948	1704	rundll32.exe	29
PID 1704 wrote to memory of 2948	1704	rundll32.exe	29
PID 1704 wrote to memory of 2948	1704	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5544a04db7c4d7565ba6385deba25e43c2cdc51bbc07491589941fa01de73c7f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5544a04db7c4d7565ba6385deba25e43c2cdc51bbc07491589941fa01de73c7f.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 232
    3⤵
    - Program crash
    PID:2948