dca07b54cea3b995b2135cbaf3b73370b815530605196787b8e4099c03309b8a

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 01:22

Target

dca07b54cea3b995b2135cbaf3b73370b815530605196787b8e4099c03309b8a.dll
Size

208KB
MD5

4cd9b633ba45bb7fe98dd5860ad8a47c
SHA1

8f83583e9ac3ffde2ab16fd26a0af2a70b6b9ddb
SHA256

dca07b54cea3b995b2135cbaf3b73370b815530605196787b8e4099c03309b8a
SHA512

4c65cb6385d65a8fe24795cf8d3d25bb7835293006b01be80c38380edba6a5b538c03f97bf9ad9a740448498421b12b284aabda8694f60f0006945b6623d9676
SSDEEP

3072:LI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdUDY5a:LIDff9D8C6XYRw6MT2DEj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2132 2596 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2132	2596	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2696 wrote to memory of 2596	2696	rundll32.exe	rundll32.exe
PID 2696 wrote to memory of 2596	2696	rundll32.exe	rundll32.exe
PID 2696 wrote to memory of 2596	2696	rundll32.exe	rundll32.exe
PID 2696 wrote to memory of 2596	2696	rundll32.exe	rundll32.exe
PID 2696 wrote to memory of 2596	2696	rundll32.exe	rundll32.exe
PID 2696 wrote to memory of 2596	2696	rundll32.exe	rundll32.exe
PID 2696 wrote to memory of 2596	2696	rundll32.exe	rundll32.exe
PID 2596 wrote to memory of 2132	2596	rundll32.exe	WerFault.exe
PID 2596 wrote to memory of 2132	2596	rundll32.exe	WerFault.exe
PID 2596 wrote to memory of 2132	2596	rundll32.exe	WerFault.exe
PID 2596 wrote to memory of 2132	2596	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dca07b54cea3b995b2135cbaf3b73370b815530605196787b8e4099c03309b8a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2696

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dca07b54cea3b995b2135cbaf3b73370b815530605196787b8e4099c03309b8a.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2596 -s 232
3⤵
- Program crash
PID:2132