f7ef943775334a5a15a925f35584cf18d55ccca4fa2c90df1e58a613d84c973b

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 04:13

Target

f7ef943775334a5a15a925f35584cf18d55ccca4fa2c90df1e58a613d84c973b.dll
Size

208KB
MD5

6495489f64dce65a99c1cc567a539e8b
SHA1

43cda2925453c964ed4d8a71e574b81fd6af4b26
SHA256

f7ef943775334a5a15a925f35584cf18d55ccca4fa2c90df1e58a613d84c973b
SHA512

19e1eb7cb631fa64fcd4cc54692944b9311e2a178434d8cd5ce98027374ceed9c4154c5ab3683a38446564b81e66322f6ee8c3b01dbd6ec473dff2a9e44b1a22
SSDEEP

3072:LI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdUbY50:LIDff9D8C6XYRw6MT2DEj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2668 2880 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2668	2880	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2332 wrote to memory of 2880	2332	rundll32.exe	rundll32.exe
PID 2332 wrote to memory of 2880	2332	rundll32.exe	rundll32.exe
PID 2332 wrote to memory of 2880	2332	rundll32.exe	rundll32.exe
PID 2332 wrote to memory of 2880	2332	rundll32.exe	rundll32.exe
PID 2332 wrote to memory of 2880	2332	rundll32.exe	rundll32.exe
PID 2332 wrote to memory of 2880	2332	rundll32.exe	rundll32.exe
PID 2332 wrote to memory of 2880	2332	rundll32.exe	rundll32.exe
PID 2880 wrote to memory of 2668	2880	rundll32.exe	WerFault.exe
PID 2880 wrote to memory of 2668	2880	rundll32.exe	WerFault.exe
PID 2880 wrote to memory of 2668	2880	rundll32.exe	WerFault.exe
PID 2880 wrote to memory of 2668	2880	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7ef943775334a5a15a925f35584cf18d55ccca4fa2c90df1e58a613d84c973b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7ef943775334a5a15a925f35584cf18d55ccca4fa2c90df1e58a613d84c973b.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2880
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 232
    3⤵
    - Program crash
    PID:2668