b0623b791beaec60b99d2d3f2d03c31e2a3bbe18ea1e78c4bc60b4115f8e920c

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
24-10-2023 03:34

Target

b0623b791beaec60b99d2d3f2d03c31e2a3bbe18ea1e78c4bc60b4115f8e920c.dll
Size

208KB
MD5

c0c9e8493ac55c1d1d66eba7adf4c449
SHA1

32a5c25bcc793f48f2cf20620da298f4bc52e118
SHA256

b0623b791beaec60b99d2d3f2d03c31e2a3bbe18ea1e78c4bc60b4115f8e920c
SHA512

b1f9e0b3fedeb80efe2385691a2b8682beaef87e25c38eeb6cd9040dccacd7c4ec25cf33f3869e7a6ab6585fa0d34eddb882050fa0e1d36f7971c63adaaa2b1d
SSDEEP

3072:LI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdU/Y5K:LIDff9D8C6XYRw6MT2DEj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2672 3024 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2672	3024	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2208 wrote to memory of 3024	2208	rundll32.exe	rundll32.exe
PID 2208 wrote to memory of 3024	2208	rundll32.exe	rundll32.exe
PID 2208 wrote to memory of 3024	2208	rundll32.exe	rundll32.exe
PID 2208 wrote to memory of 3024	2208	rundll32.exe	rundll32.exe
PID 2208 wrote to memory of 3024	2208	rundll32.exe	rundll32.exe
PID 2208 wrote to memory of 3024	2208	rundll32.exe	rundll32.exe
PID 2208 wrote to memory of 3024	2208	rundll32.exe	rundll32.exe
PID 3024 wrote to memory of 2672	3024	rundll32.exe	WerFault.exe
PID 3024 wrote to memory of 2672	3024	rundll32.exe	WerFault.exe
PID 3024 wrote to memory of 2672	3024	rundll32.exe	WerFault.exe
PID 3024 wrote to memory of 2672	3024	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b0623b791beaec60b99d2d3f2d03c31e2a3bbe18ea1e78c4bc60b4115f8e920c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2208

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b0623b791beaec60b99d2d3f2d03c31e2a3bbe18ea1e78c4bc60b4115f8e920c.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:3024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 232
3⤵
- Program crash
PID:2672