f6f47c13c758bf9a412ff89d691dc5f399168f836bf9bc30f6beec7d3eaf8cd5

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/12/2023, 13:23

Target

31ed4d525d0332cf07295eb6fcd2e217.dll
Size

54KB
MD5

31ed4d525d0332cf07295eb6fcd2e217
SHA1

93b044c9a0854a6d2601c448d0607dfcdb1dbb6e
SHA256

f6f47c13c758bf9a412ff89d691dc5f399168f836bf9bc30f6beec7d3eaf8cd5
SHA512

d6ef69a9e9847eabf67ab381a2cec0d06ad0a978aa2771ff5ad920f044791d6f5b02c20aa9e1e3c0676c5fdbed000ec8a1bd6268ab7b892f1d6d77fd9308ce88
SSDEEP

1536:oZ/ii4jHr6Da+f4N6HA7ppmXjUvnToIfAIOO87d:o4Oa+TH0WjwTBf2J7d

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2208	2224	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 2224	1664	rundll32.exe	28
PID 1664 wrote to memory of 2224	1664	rundll32.exe	28
PID 1664 wrote to memory of 2224	1664	rundll32.exe	28
PID 1664 wrote to memory of 2224	1664	rundll32.exe	28
PID 1664 wrote to memory of 2224	1664	rundll32.exe	28
PID 1664 wrote to memory of 2224	1664	rundll32.exe	28
PID 1664 wrote to memory of 2224	1664	rundll32.exe	28
PID 2224 wrote to memory of 2208	2224	rundll32.exe	29
PID 2224 wrote to memory of 2208	2224	rundll32.exe	29
PID 2224 wrote to memory of 2208	2224	rundll32.exe	29
PID 2224 wrote to memory of 2208	2224	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\31ed4d525d0332cf07295eb6fcd2e217.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\31ed4d525d0332cf07295eb6fcd2e217.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 228
    3⤵
    - Program crash
    PID:2208