c513ebc530a9dce3f42131047abe02397966e2ea33f4bde231413fcdcfc07292

Analysis

max time kernel
117s
max time network
134s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
18-10-2023 21:02

Target

c513ebc530a9dce3f42131047abe02397966e2ea33f4bde231413fcdcfc07292.dll
Size

208KB
MD5

ba3bd1cf9f4559c81c7793acc96175ac
SHA1

7b95f4409fcb3ed57c8f32c8103ed650b1059d3d
SHA256

c513ebc530a9dce3f42131047abe02397966e2ea33f4bde231413fcdcfc07292
SHA512

14d7777fe3c694ec0001f4f9827fd08b52ff9234c670649ee21b16c1d943880ab40f780821f4d65d56e838a22cf358e99ec60ed98ca3c025c4fbd583a2f83be2
SSDEEP

3072:LI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdUjY5vQ:LIDff9D8C6XYRw6MT2DEj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2092 2596 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2092	2596	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2468 wrote to memory of 2596	2468	rundll32.exe	rundll32.exe
PID 2468 wrote to memory of 2596	2468	rundll32.exe	rundll32.exe
PID 2468 wrote to memory of 2596	2468	rundll32.exe	rundll32.exe
PID 2468 wrote to memory of 2596	2468	rundll32.exe	rundll32.exe
PID 2468 wrote to memory of 2596	2468	rundll32.exe	rundll32.exe
PID 2468 wrote to memory of 2596	2468	rundll32.exe	rundll32.exe
PID 2468 wrote to memory of 2596	2468	rundll32.exe	rundll32.exe
PID 2596 wrote to memory of 2092	2596	rundll32.exe	WerFault.exe
PID 2596 wrote to memory of 2092	2596	rundll32.exe	WerFault.exe
PID 2596 wrote to memory of 2092	2596	rundll32.exe	WerFault.exe
PID 2596 wrote to memory of 2092	2596	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c513ebc530a9dce3f42131047abe02397966e2ea33f4bde231413fcdcfc07292.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2468

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c513ebc530a9dce3f42131047abe02397966e2ea33f4bde231413fcdcfc07292.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2596 -s 232
3⤵
- Program crash
PID:2092