4f35f0d7fe46af69db3bd677b3d3821a1f6c5c00229ed617a6deeff3a79a104f

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
09-11-2023 21:45

Target

4f35f0d7fe46af69db3bd677b3d3821a1f6c5c00229ed617a6deeff3a79a104f.dll
Size

208KB
MD5

7b02739ded020c20b49b04047773f5a0
SHA1

66cb3423f35cf9a513c5501afc438d170729cee1
SHA256

4f35f0d7fe46af69db3bd677b3d3821a1f6c5c00229ed617a6deeff3a79a104f
SHA512

b870a5d0d53511d6ef286b1b1683a9611305a5b6c3a4cacab619382cae0e34b6a6fae8e2b2f8c992b936ca4b6d8e70ffa97dabef2e7c0681d77e3c2a3d25054b
SSDEEP

3072:LI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdUuY5M:LIDff9D8C6XYRw6MT2DEj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1104 2044 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1104	2044	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1944 wrote to memory of 2044	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 2044	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 2044	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 2044	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 2044	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 2044	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 2044	1944	rundll32.exe	rundll32.exe
PID 2044 wrote to memory of 1104	2044	rundll32.exe	WerFault.exe
PID 2044 wrote to memory of 1104	2044	rundll32.exe	WerFault.exe
PID 2044 wrote to memory of 1104	2044	rundll32.exe	WerFault.exe
PID 2044 wrote to memory of 1104	2044	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4f35f0d7fe46af69db3bd677b3d3821a1f6c5c00229ed617a6deeff3a79a104f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1944

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4f35f0d7fe46af69db3bd677b3d3821a1f6c5c00229ed617a6deeff3a79a104f.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 232
3⤵
- Program crash
PID:1104