180032f8413bd4e58a4b135f246f3a15737c0403dab4e5ced1af4be32cecf5e1

Analysis

max time kernel
117s
max time network
142s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
03/11/2023, 15:54

Target

180032f8413bd4e58a4b135f246f3a15737c0403dab4e5ced1af4be32cecf5e1.dll
Size

1.9MB
MD5

4c771f9f585b40d9e82147272d675a4a
SHA1

b18097e86f2303b16b2aac0f2f736e779252655e
SHA256

180032f8413bd4e58a4b135f246f3a15737c0403dab4e5ced1af4be32cecf5e1
SHA512

598f9a0d78af752ff51d6a54c7350d11654311dead36461ae43ced2810680c4ccb514a62eb9067e246c1f4cb5f5cf3f7f35de2abcf04224a25c28b9fa70a9132
SSDEEP

49152:f7Xm3BjLDHOQ2XY4XCkJX0uOPp7NrcUTh9V4/9w:f7XYBjnuRXXXno7NrD5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1376	1036	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 1036	844	rundll32.exe	30
PID 844 wrote to memory of 1036	844	rundll32.exe	30
PID 844 wrote to memory of 1036	844	rundll32.exe	30
PID 844 wrote to memory of 1036	844	rundll32.exe	30
PID 844 wrote to memory of 1036	844	rundll32.exe	30
PID 844 wrote to memory of 1036	844	rundll32.exe	30
PID 844 wrote to memory of 1036	844	rundll32.exe	30
PID 1036 wrote to memory of 1376	1036	rundll32.exe	31
PID 1036 wrote to memory of 1376	1036	rundll32.exe	31
PID 1036 wrote to memory of 1376	1036	rundll32.exe	31
PID 1036 wrote to memory of 1376	1036	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\180032f8413bd4e58a4b135f246f3a15737c0403dab4e5ced1af4be32cecf5e1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\180032f8413bd4e58a4b135f246f3a15737c0403dab4e5ced1af4be32cecf5e1.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1036
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1036 -s 268
    3⤵
    - Program crash
    PID:1376