3a3131b7e3cf6bc80a6af4331e543fe57b890716018b1b1addb7bf8d2de4f815

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 15:35

Target

da787c9ee3059b56650c2b9801cd77a9.dll
Size

2.0MB
MD5

da787c9ee3059b56650c2b9801cd77a9
SHA1

b3e390f794c30f192476e43c371f7eb544f0d214
SHA256

3a3131b7e3cf6bc80a6af4331e543fe57b890716018b1b1addb7bf8d2de4f815
SHA512

c5c85cb788d52f3c78beb9cf584e3683dd9a47649323e569dbcf2f7ba332170a7244c60778758df7800941f74b62f3a8db4a26824c87c4c5167bd48cfdfb67da
SSDEEP

24576:dmFyjLF847eiWWcoGZVOIxh/WxIAIbG+JJJJmmFyjLF847eiWWcoGZVOIxh/WxIy:t+ZVX+xIPbdJJJJK+ZVX+xIPb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2196	2204	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 688 wrote to memory of 2204	688	rundll32.exe	28
PID 688 wrote to memory of 2204	688	rundll32.exe	28
PID 688 wrote to memory of 2204	688	rundll32.exe	28
PID 688 wrote to memory of 2204	688	rundll32.exe	28
PID 688 wrote to memory of 2204	688	rundll32.exe	28
PID 688 wrote to memory of 2204	688	rundll32.exe	28
PID 688 wrote to memory of 2204	688	rundll32.exe	28
PID 2204 wrote to memory of 2196	2204	rundll32.exe	29
PID 2204 wrote to memory of 2196	2204	rundll32.exe	29
PID 2204 wrote to memory of 2196	2204	rundll32.exe	29
PID 2204 wrote to memory of 2196	2204	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\da787c9ee3059b56650c2b9801cd77a9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\da787c9ee3059b56650c2b9801cd77a9.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 224
    3⤵
    - Program crash
    PID:2196