d399423ec72823d94eb090d43a12f7fa99b4e7c7278dc26b5b0ced97143bc76d

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
21/11/2023, 20:01

Target

d399423ec72823d94eb090d43a12f7fa99b4e7c7278dc26b5b0ced97143bc76d.dll
Size

254KB
MD5

781c6a326062e264fe0db6aaf0009ece
SHA1

3b577d356a6b9a6d3b63cde90c1a481fba36ff3e
SHA256

d399423ec72823d94eb090d43a12f7fa99b4e7c7278dc26b5b0ced97143bc76d
SHA512

db78c0f4ac928faa85c0861738f33260bef7b8282140e9e5fa744a432f47ee8f4a86c553a96aafa1232cb2d51a2dceef9185b287bbe7c2086d4f91c3124efe2b
SSDEEP

3072:jxeZ6p7bxHSgOVNHGyHKmitOUpvSBjxRHSoQN9W8ei/b7h2jV+Hl9c2:l86p7gV5Gy1i/pwylN9Ww/bV2Kl9c

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2172	2032	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 2032	1676	rundll32.exe	28
PID 1676 wrote to memory of 2032	1676	rundll32.exe	28
PID 1676 wrote to memory of 2032	1676	rundll32.exe	28
PID 1676 wrote to memory of 2032	1676	rundll32.exe	28
PID 1676 wrote to memory of 2032	1676	rundll32.exe	28
PID 1676 wrote to memory of 2032	1676	rundll32.exe	28
PID 1676 wrote to memory of 2032	1676	rundll32.exe	28
PID 2032 wrote to memory of 2172	2032	rundll32.exe	29
PID 2032 wrote to memory of 2172	2032	rundll32.exe	29
PID 2032 wrote to memory of 2172	2032	rundll32.exe	29
PID 2032 wrote to memory of 2172	2032	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d399423ec72823d94eb090d43a12f7fa99b4e7c7278dc26b5b0ced97143bc76d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d399423ec72823d94eb090d43a12f7fa99b4e7c7278dc26b5b0ced97143bc76d.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 252
    3⤵
    - Program crash
    PID:2172