543cc37b5010a62b76a15a80540a8c6fdc63e313863e6d0b7791fdffa19af6b2

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
25-10-2023 02:51

Target

543cc37b5010a62b76a15a80540a8c6fdc63e313863e6d0b7791fdffa19af6b2.dll
Size

203KB
MD5

0c24cde711c859a0779c98495e6db739
SHA1

cde5ab9a927e9be986c90b6d80cc5bfc6916d978
SHA256

543cc37b5010a62b76a15a80540a8c6fdc63e313863e6d0b7791fdffa19af6b2
SHA512

e60570cc295c309d28308c9b330a701f692d8a03cb816184027b4c8fac629aa21b153984eb79da6245d0048b655cb0dda6002dcc1c628db2fbc627572b2c7d97
SSDEEP

3072:PGfpVbhIoHE8ConnRVSEDlAZk1GkZX5aWWjEU0Z5IWFE/:ObhIok8ConR5hAQ5atjctE

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2576 1860 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2576	1860	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1932 wrote to memory of 1860	1932	rundll32.exe	rundll32.exe
PID 1932 wrote to memory of 1860	1932	rundll32.exe	rundll32.exe
PID 1932 wrote to memory of 1860	1932	rundll32.exe	rundll32.exe
PID 1932 wrote to memory of 1860	1932	rundll32.exe	rundll32.exe
PID 1932 wrote to memory of 1860	1932	rundll32.exe	rundll32.exe
PID 1932 wrote to memory of 1860	1932	rundll32.exe	rundll32.exe
PID 1932 wrote to memory of 1860	1932	rundll32.exe	rundll32.exe
PID 1860 wrote to memory of 2576	1860	rundll32.exe	WerFault.exe
PID 1860 wrote to memory of 2576	1860	rundll32.exe	WerFault.exe
PID 1860 wrote to memory of 2576	1860	rundll32.exe	WerFault.exe
PID 1860 wrote to memory of 2576	1860	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\543cc37b5010a62b76a15a80540a8c6fdc63e313863e6d0b7791fdffa19af6b2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1932

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\543cc37b5010a62b76a15a80540a8c6fdc63e313863e6d0b7791fdffa19af6b2.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 224
3⤵
- Program crash
PID:2576