37fc8926a1e52e11a247fbc28c4a05ec5125e1d17c5344bebd53a82cd703a904

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
28/10/2023, 17:01

Target

37fc8926a1e52e11a247fbc28c4a05ec5125e1d17c5344bebd53a82cd703a904.dll
Size

200KB
MD5

8a0261e819d46a89a327e08742de9ee5
SHA1

04895a479a345f504f11bbb7a47c13b93dd3ac6a
SHA256

37fc8926a1e52e11a247fbc28c4a05ec5125e1d17c5344bebd53a82cd703a904
SHA512

9fa78e33fad23af72c64f5e9ecfd92140fcfc668063926e1223bdfc3fd97f0a2c5a8dfbb4e88abbdf78f6a9cd918c3ae672d378fdefd0f7c70d469e538b0ef25
SSDEEP

3072:1n5hItSqz8/T5wfLgwyHZKis17J/BRbU7pninIDmwr73Fp1cntw/cTiX:L2tR8/T5wTgwziqZRWiZy/v

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1916	2164	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2164	2924	rundll32.exe	28
PID 2924 wrote to memory of 2164	2924	rundll32.exe	28
PID 2924 wrote to memory of 2164	2924	rundll32.exe	28
PID 2924 wrote to memory of 2164	2924	rundll32.exe	28
PID 2924 wrote to memory of 2164	2924	rundll32.exe	28
PID 2924 wrote to memory of 2164	2924	rundll32.exe	28
PID 2924 wrote to memory of 2164	2924	rundll32.exe	28
PID 2164 wrote to memory of 1916	2164	rundll32.exe	29
PID 2164 wrote to memory of 1916	2164	rundll32.exe	29
PID 2164 wrote to memory of 1916	2164	rundll32.exe	29
PID 2164 wrote to memory of 1916	2164	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\37fc8926a1e52e11a247fbc28c4a05ec5125e1d17c5344bebd53a82cd703a904.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\37fc8926a1e52e11a247fbc28c4a05ec5125e1d17c5344bebd53a82cd703a904.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 228
    3⤵
    - Program crash
    PID:1916