0edbb60d12b7f5603b13bfbb8644a167ffb317fa1aef8f276006b8bfabfaf223

Analysis

max time kernel
120s
max time network
143s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10/10/2023, 21:25

Target

WindowsTask/DuiLib_u.dll
Size

459KB
MD5

56072dfb985e2108f83088fc53eb8d28
SHA1

7511fa54087b8a3f6b15f35e93b348dbb77ba90e
SHA256

86a5bb96638aee5f0472f5ba1e0684fc9fe7d978c7144c674c364392fb251342
SHA512

514fe9279bb3b0c82c37ebcbb3667c2057b5f9c2fd3317fd175bd0cab1ca7cddc60e45a53949e8c185936af7e3de3bb1953596b7b0bad26e3eaa7e4391597130
SSDEEP

6144:h1Vwlasn7VKQG3uBk7X17A1pU6GKZh/7eOsXMm:LqLB8X17AY6nZhaOsH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2676	2816	WerFault.exe	29

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 2816	2760	rundll32.exe	29
PID 2760 wrote to memory of 2816	2760	rundll32.exe	29
PID 2760 wrote to memory of 2816	2760	rundll32.exe	29
PID 2760 wrote to memory of 2816	2760	rundll32.exe	29
PID 2760 wrote to memory of 2816	2760	rundll32.exe	29
PID 2760 wrote to memory of 2816	2760	rundll32.exe	29
PID 2760 wrote to memory of 2816	2760	rundll32.exe	29
PID 2816 wrote to memory of 2676	2816	rundll32.exe	30
PID 2816 wrote to memory of 2676	2816	rundll32.exe	30
PID 2816 wrote to memory of 2676	2816	rundll32.exe	30
PID 2816 wrote to memory of 2676	2816	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WindowsTask\DuiLib_u.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\WindowsTask\DuiLib_u.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 232
    3⤵
    - Program crash
    PID:2676