f4d72516e3e60d2cd3a103c227be0dd923578e932bec9121b6d134d96b4d0984

Analysis

max time kernel
122s
max time network
150s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07-11-2023 14:11

Target

Programs/Imager/ProfUIS284ad32.dll
Size

9.6MB
MD5

e56651b0cadcc180d1bfcc23232a27a3
SHA1

7a46667052ede2ce1f8699fe6f51f7a5a398229f
SHA256

5e48c5240bf20f2669caba2d8bf893c7b7a929a7d518b139f908bdb890d8832a
SHA512

7e625b8c35b71c2586d6333ee6f7e0ac641e9b5f12b463ec9721758b54a5599997ad303ebdf5a18123f222d3f39352bb03a2560464ec53a792be959fefc35120
SSDEEP

98304:lufMnqmbKzKIAiohbLm/pNY6wPWpGplR808MnmkkC:lMmbo7abLmw6wPWpGplR80qkb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2696	2684	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 2684	2616	rundll32.exe	30
PID 2616 wrote to memory of 2684	2616	rundll32.exe	30
PID 2616 wrote to memory of 2684	2616	rundll32.exe	30
PID 2616 wrote to memory of 2684	2616	rundll32.exe	30
PID 2616 wrote to memory of 2684	2616	rundll32.exe	30
PID 2616 wrote to memory of 2684	2616	rundll32.exe	30
PID 2616 wrote to memory of 2684	2616	rundll32.exe	30
PID 2684 wrote to memory of 2696	2684	rundll32.exe	31
PID 2684 wrote to memory of 2696	2684	rundll32.exe	31
PID 2684 wrote to memory of 2696	2684	rundll32.exe	31
PID 2684 wrote to memory of 2696	2684	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Programs\Imager\ProfUIS284ad32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Programs\Imager\ProfUIS284ad32.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 252
    3⤵
    - Program crash
    PID:2696