06ac60dd14b4e99f52e9be202ae7466a8ad2a828a04d14bfb7a512e715d009bf

Analysis

max time kernel
118s
max time network
131s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 07:30

Target

06ac60dd14b4e99f52e9be202ae7466a8ad2a828a04d14bfb7a512e715d009bf.dll
Size

218KB
MD5

646a20e0d0e380c7b75a3c44c95ee931
SHA1

48c93e6ec058164f6ec5228546392eee2f4d6744
SHA256

06ac60dd14b4e99f52e9be202ae7466a8ad2a828a04d14bfb7a512e715d009bf
SHA512

5e535541d5930521b29a8cbfa40eab25c57f006e3d1fd80e0499e15bf350ba8e4d34119d5f1f0b9fbbe11174978f33c2c626f9affe7f3ff4b49dd6f49e6f0ad5
SSDEEP

3072:tfyTFpXSc43UtiD8Umh8I6lk0bF+EjJeNDU2a7i78nifiRjdURZ52eBS:tfsD4ktiD8UI8I66C+6AsXnifujkh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3000	1724	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 1724	2444	rundll32.exe	28
PID 2444 wrote to memory of 1724	2444	rundll32.exe	28
PID 2444 wrote to memory of 1724	2444	rundll32.exe	28
PID 2444 wrote to memory of 1724	2444	rundll32.exe	28
PID 2444 wrote to memory of 1724	2444	rundll32.exe	28
PID 2444 wrote to memory of 1724	2444	rundll32.exe	28
PID 2444 wrote to memory of 1724	2444	rundll32.exe	28
PID 1724 wrote to memory of 3000	1724	rundll32.exe	29
PID 1724 wrote to memory of 3000	1724	rundll32.exe	29
PID 1724 wrote to memory of 3000	1724	rundll32.exe	29
PID 1724 wrote to memory of 3000	1724	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06ac60dd14b4e99f52e9be202ae7466a8ad2a828a04d14bfb7a512e715d009bf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\06ac60dd14b4e99f52e9be202ae7466a8ad2a828a04d14bfb7a512e715d009bf.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 232
    3⤵
    - Program crash
    PID:3000