a2286ef2d2d20bc29aa0aa9fcb832f91986c1c57b0b5ce84f700c71bd28268ca

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
17/11/2023, 11:42

Target

a2286ef2d2d20bc29aa0aa9fcb832f91986c1c57b0b5ce84f700c71bd28268ca.dll
Size

1.1MB
MD5

af357ef9c0921046c167e59be8cb56dd
SHA1

8fcd662c13e7c9b898d2da011567b44c3bd14536
SHA256

a2286ef2d2d20bc29aa0aa9fcb832f91986c1c57b0b5ce84f700c71bd28268ca
SHA512

67224ca57b037692226714c7e56b9bc52f13d6889ddb1fefb1f8af29be3d813f67992a8a57e3be57170b5a3ea36def14a3ad787dd3e82dc7bb8215e26833ac0a
SSDEEP

24576:5HsZDeMHz7K54f89XHYBDw+81KRzAXs9:weMHzPfKXHYRwjKRz8s9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2444	2272	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2272	2196	rundll32.exe	28
PID 2196 wrote to memory of 2272	2196	rundll32.exe	28
PID 2196 wrote to memory of 2272	2196	rundll32.exe	28
PID 2196 wrote to memory of 2272	2196	rundll32.exe	28
PID 2196 wrote to memory of 2272	2196	rundll32.exe	28
PID 2196 wrote to memory of 2272	2196	rundll32.exe	28
PID 2196 wrote to memory of 2272	2196	rundll32.exe	28
PID 2272 wrote to memory of 2444	2272	rundll32.exe	29
PID 2272 wrote to memory of 2444	2272	rundll32.exe	29
PID 2272 wrote to memory of 2444	2272	rundll32.exe	29
PID 2272 wrote to memory of 2444	2272	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a2286ef2d2d20bc29aa0aa9fcb832f91986c1c57b0b5ce84f700c71bd28268ca.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a2286ef2d2d20bc29aa0aa9fcb832f91986c1c57b0b5ce84f700c71bd28268ca.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 224
    3⤵
    - Program crash
    PID:2444