32cfb555f19fd90d2c92fd89453d16388b18f2808dcb21186e4375d49c8b0620

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19-12-2023 10:30

Target

0696e1297cfd2bb2d72c9180855457fa.dll
Size

104KB
MD5

0696e1297cfd2bb2d72c9180855457fa
SHA1

73b54438f86c88aa559702cf52f92d68196f172f
SHA256

32cfb555f19fd90d2c92fd89453d16388b18f2808dcb21186e4375d49c8b0620
SHA512

8517373d9ea2ff91af4a9d2117abfa66987a0f086b97c643f3785f4d522d0ddc8512fed2667c1131fa6366edb6b534f73a055126c5634b3d90269af58d71ba5a
SSDEEP

1536:6WGfGAXqrlOjRsu0R7mfJdYCD0EczMY3cFJeg0Hv75jcTZr03Wklk9ncobUfs/Ga:DGfGAilO2InDYE2JaAxlkrjGP8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2368	2292	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 2292	812	rundll32.exe	28
PID 812 wrote to memory of 2292	812	rundll32.exe	28
PID 812 wrote to memory of 2292	812	rundll32.exe	28
PID 812 wrote to memory of 2292	812	rundll32.exe	28
PID 812 wrote to memory of 2292	812	rundll32.exe	28
PID 812 wrote to memory of 2292	812	rundll32.exe	28
PID 812 wrote to memory of 2292	812	rundll32.exe	28
PID 2292 wrote to memory of 2368	2292	rundll32.exe	29
PID 2292 wrote to memory of 2368	2292	rundll32.exe	29
PID 2292 wrote to memory of 2368	2292	rundll32.exe	29
PID 2292 wrote to memory of 2368	2292	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0696e1297cfd2bb2d72c9180855457fa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0696e1297cfd2bb2d72c9180855457fa.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 272
    3⤵
    - Program crash
    PID:2368