aa2c3f6904cddfe9f9362d1b23c9e0d7788c5028ccbc8c2c60456b51dbacb062

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
13/11/2023, 12:55

Target

aa2c3f6904cddfe9f9362d1b23c9e0d7788c5028ccbc8c2c60456b51dbacb062.dll
Size

721KB
MD5

ff2d831360e960dd3188a26489b154ac
SHA1

54cba80348f40367daa6109114c8794bbf5d561a
SHA256

aa2c3f6904cddfe9f9362d1b23c9e0d7788c5028ccbc8c2c60456b51dbacb062
SHA512

599a626f6a15059ee69a61ecc77f79326cee444cc3e54eedcd410b14551bfde32d0d5600cde653b165b08c2ebf5bd7b02043d6bebb2aeeb2454050082b7e17ee
SSDEEP

12288:C2uNkMNJNPwx+ZmkSnGODpQb2LEBkudYiI8ut7m4sT2LWKl7twY:CQMucmrzd3udFC3saLn72Y

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2544	2212	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2212	2924	rundll32.exe	28
PID 2924 wrote to memory of 2212	2924	rundll32.exe	28
PID 2924 wrote to memory of 2212	2924	rundll32.exe	28
PID 2924 wrote to memory of 2212	2924	rundll32.exe	28
PID 2924 wrote to memory of 2212	2924	rundll32.exe	28
PID 2924 wrote to memory of 2212	2924	rundll32.exe	28
PID 2924 wrote to memory of 2212	2924	rundll32.exe	28
PID 2212 wrote to memory of 2544	2212	rundll32.exe	29
PID 2212 wrote to memory of 2544	2212	rundll32.exe	29
PID 2212 wrote to memory of 2544	2212	rundll32.exe	29
PID 2212 wrote to memory of 2544	2212	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa2c3f6904cddfe9f9362d1b23c9e0d7788c5028ccbc8c2c60456b51dbacb062.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa2c3f6904cddfe9f9362d1b23c9e0d7788c5028ccbc8c2c60456b51dbacb062.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 256
    3⤵
    - Program crash
    PID:2544