b7c5563e4ab751c62fc6e2f1be3b41459459d0ebe9c47e3e49c7b9e58cd0a9fb

Analysis

max time kernel
120s
max time network
150s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10-10-2023 22:16

Target

b7c5563e4ab751c62fc6e2f1be3b41459459d0ebe9c47e3e49c7b9e58cd0a9fb.dll
Size

206KB
MD5

5a4e0f99e59f60990ad2c99a678978d0
SHA1

9d677be94d08f7c459a224d3f45272004ab9ef65
SHA256

b7c5563e4ab751c62fc6e2f1be3b41459459d0ebe9c47e3e49c7b9e58cd0a9fb
SHA512

4815dae880aa4b39bd1358b60c19f768d32b678cddcac0292530555c98f2a1e703400b4d7d095c4d19f8e3eb16ff5ba5e5b4d35980b864800d20ff098013ad4a
SSDEEP

3072:ZnT2RRXuwcN3OQXB8CITr9VV2ILe126JyTuBdjdUn5BXj:ZwXupN1x8CgBbRLDTuLj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2648	2676	WerFault.exe	29

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2676	2776	rundll32.exe	29
PID 2776 wrote to memory of 2676	2776	rundll32.exe	29
PID 2776 wrote to memory of 2676	2776	rundll32.exe	29
PID 2776 wrote to memory of 2676	2776	rundll32.exe	29
PID 2776 wrote to memory of 2676	2776	rundll32.exe	29
PID 2776 wrote to memory of 2676	2776	rundll32.exe	29
PID 2776 wrote to memory of 2676	2776	rundll32.exe	29
PID 2676 wrote to memory of 2648	2676	rundll32.exe	30
PID 2676 wrote to memory of 2648	2676	rundll32.exe	30
PID 2676 wrote to memory of 2648	2676	rundll32.exe	30
PID 2676 wrote to memory of 2648	2676	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b7c5563e4ab751c62fc6e2f1be3b41459459d0ebe9c47e3e49c7b9e58cd0a9fb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b7c5563e4ab751c62fc6e2f1be3b41459459d0ebe9c47e3e49c7b9e58cd0a9fb.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 232
    3⤵
    - Program crash
    PID:2648