05f27a1fa26b057be958e4e97f591dd44bdd269148e460f40eb9bdf52933347f

Analysis

max time kernel
119s
max time network
130s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 14:18

Target

05f27a1fa26b057be958e4e97f591dd44bdd269148e460f40eb9bdf52933347f.dll
Size

172KB
MD5

c8620e1f9880121a7220a8ce934ea0d5
SHA1

3c5a2c7b13c528020b26ddccde41dd7e5790b32f
SHA256

05f27a1fa26b057be958e4e97f591dd44bdd269148e460f40eb9bdf52933347f
SHA512

cf1770e53cea490d4eda68553da8c1765f309dc042405d6c8fbb28fba0599a43304bd19c6b07e169ae0304a8c2b7d15d1438251c9ab35b8361ff4342f0210b74
SSDEEP

3072:0oxcqIpoxcqIl6gP6gM8/I68/IpsWesWrjp5:zxSGxSlLPLm4m/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2332	1824	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1824	1724	rundll32.exe	28
PID 1724 wrote to memory of 1824	1724	rundll32.exe	28
PID 1724 wrote to memory of 1824	1724	rundll32.exe	28
PID 1724 wrote to memory of 1824	1724	rundll32.exe	28
PID 1724 wrote to memory of 1824	1724	rundll32.exe	28
PID 1724 wrote to memory of 1824	1724	rundll32.exe	28
PID 1724 wrote to memory of 1824	1724	rundll32.exe	28
PID 1824 wrote to memory of 2332	1824	rundll32.exe	29
PID 1824 wrote to memory of 2332	1824	rundll32.exe	29
PID 1824 wrote to memory of 2332	1824	rundll32.exe	29
PID 1824 wrote to memory of 2332	1824	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\05f27a1fa26b057be958e4e97f591dd44bdd269148e460f40eb9bdf52933347f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\05f27a1fa26b057be958e4e97f591dd44bdd269148e460f40eb9bdf52933347f.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1824
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 196
    3⤵
    - Program crash
    PID:2332