4508751251f71301ad27604a65de0dc67ca8c284701de7e7ed1e204e9a60a8de

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19-12-2023 14:26

Target

427f94bb1e4bcab425a637e31ba06cd8.dll
Size

106KB
MD5

427f94bb1e4bcab425a637e31ba06cd8
SHA1

b354acc48de4094eb576f34ee82bd4388b218ec5
SHA256

4508751251f71301ad27604a65de0dc67ca8c284701de7e7ed1e204e9a60a8de
SHA512

71a092242d0e6b69b64963c72d7c388ae137e51f8bbf45eb5bbccfef0c08d299a3d3336cab9792d9cdd4e9413300c4485a730c9a7c8d3035d8c584515ebbe4f9
SSDEEP

1536:0C2NGAbBo+DCsu0+KmggRz1c+ablzW+dOU7rQczHq3H8wx423WklV9ncobUfsxDe:V2NGAq+5SpfEdDxwbxlVr1Ri+h

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
616	1568	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 1568	1708	rundll32.exe	27
PID 1708 wrote to memory of 1568	1708	rundll32.exe	27
PID 1708 wrote to memory of 1568	1708	rundll32.exe	27
PID 1708 wrote to memory of 1568	1708	rundll32.exe	27
PID 1708 wrote to memory of 1568	1708	rundll32.exe	27
PID 1708 wrote to memory of 1568	1708	rundll32.exe	27
PID 1708 wrote to memory of 1568	1708	rundll32.exe	27
PID 1568 wrote to memory of 616	1568	rundll32.exe	29
PID 1568 wrote to memory of 616	1568	rundll32.exe	29
PID 1568 wrote to memory of 616	1568	rundll32.exe	29
PID 1568 wrote to memory of 616	1568	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\427f94bb1e4bcab425a637e31ba06cd8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\427f94bb1e4bcab425a637e31ba06cd8.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1568
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 264
    3⤵
    - Program crash
    PID:616