ad0bb5631f262607117452aee44ba2dd9d74a9c414a849212f05ce62e7af0766

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 15:07

Target

ad0bb5631f262607117452aee44ba2dd9d74a9c414a849212f05ce62e7af0766_JC.dll
Size

523KB
MD5

db00d1061a8b3aab60fc407cd304ab06
SHA1

915cefc8777cfc34208e27e62c6bab81d695bdd1
SHA256

ad0bb5631f262607117452aee44ba2dd9d74a9c414a849212f05ce62e7af0766
SHA512

3f0401dad893fea89b52cb0e17f22bafb76af0d78a298d834b23d018138eedc9dc9c7aae500538ef43751f067e25735b9c93ed33d4a47690bdd480c4883a16ef
SSDEEP

6144:roeIyfEl6FSWGCgjrlGsAU36UECrD1bCGWnmDAasnVI9xfyPYzBrD1bCGWnmDm:rK7D0GW6xf3D0GWR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3048	3052	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 3052	2992	rundll32.exe	28
PID 2992 wrote to memory of 3052	2992	rundll32.exe	28
PID 2992 wrote to memory of 3052	2992	rundll32.exe	28
PID 2992 wrote to memory of 3052	2992	rundll32.exe	28
PID 2992 wrote to memory of 3052	2992	rundll32.exe	28
PID 2992 wrote to memory of 3052	2992	rundll32.exe	28
PID 2992 wrote to memory of 3052	2992	rundll32.exe	28
PID 3052 wrote to memory of 3048	3052	rundll32.exe	29
PID 3052 wrote to memory of 3048	3052	rundll32.exe	29
PID 3052 wrote to memory of 3048	3052	rundll32.exe	29
PID 3052 wrote to memory of 3048	3052	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad0bb5631f262607117452aee44ba2dd9d74a9c414a849212f05ce62e7af0766_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad0bb5631f262607117452aee44ba2dd9d74a9c414a849212f05ce62e7af0766_JC.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 228
    3⤵
    - Program crash
    PID:3048