0817ebba1e998e81e7c1173f5410d13b2e401396c37a490991418241baab2d38

Analysis

max time kernel
117s
max time network
132s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07-11-2023 14:08

Target

wintaylor2.1/Programs/Imager/ADIsoDLL.dll
Size

77KB
MD5

2a35c1cc1fe308ae8f10d80f77572418
SHA1

d10de110e8818ee6179709aede09c63380226a4e
SHA256

8678244cb99c2a8ab78afe19769561c5e0e6f63a7c61e7d4f25111e6801f07d0
SHA512

7583e8cd541c70bb4e0cc94071d3f6699fdadf925c481ef355f242569a3f70ff11c385e1b534f7a12280ba49c6f00919af41ebeb5a871c1e253d89771e7c4265
SSDEEP

1536:G+dB+6vPMePWBiHfXZtiRhN+hdups2OKJTyI0:FfXZtA3p9OKJTD

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2736	2772	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2772	2684	rundll32.exe	30
PID 2684 wrote to memory of 2772	2684	rundll32.exe	30
PID 2684 wrote to memory of 2772	2684	rundll32.exe	30
PID 2684 wrote to memory of 2772	2684	rundll32.exe	30
PID 2684 wrote to memory of 2772	2684	rundll32.exe	30
PID 2684 wrote to memory of 2772	2684	rundll32.exe	30
PID 2684 wrote to memory of 2772	2684	rundll32.exe	30
PID 2772 wrote to memory of 2736	2772	rundll32.exe	31
PID 2772 wrote to memory of 2736	2772	rundll32.exe	31
PID 2772 wrote to memory of 2736	2772	rundll32.exe	31
PID 2772 wrote to memory of 2736	2772	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\wintaylor2.1\Programs\Imager\ADIsoDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\wintaylor2.1\Programs\Imager\ADIsoDLL.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 244
    3⤵
    - Program crash
    PID:2736

memory/2772-0-0x0000000000180000-0x000000000018F000-memory.dmp

Filesize
60KB

Download
memory/2772-1-0x00000000001E0000-0x00000000001EE000-memory.dmp

Filesize
56KB

Download