569d6077b226e7875403c5b1453448f57093ebb50ee36005a7bdbdeb665423e0

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 21:41

Target

13663c5d59d861a64e0a2c7508e3c46d.dll
Size

1.2MB
MD5

13663c5d59d861a64e0a2c7508e3c46d
SHA1

f6a05d61bff2384676e4e36cc69727c151ed29f7
SHA256

569d6077b226e7875403c5b1453448f57093ebb50ee36005a7bdbdeb665423e0
SHA512

f2c59f9998b81329e0bbcb03c5f3d5552a4543bfeb42f7a179d207854942a2c9144cde7d3a9d125c1f2e5c2b130c96b1dbacfa006a5c76f8ebe534359bc025de
SSDEEP

24576:2n11ApOvArsIzvtQFSOzmG4Yl7wUc7ZkTHJ83JLN:2n11AoIgxSOzEYlRqap+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2988	2180	WerFault.exe	17

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2180	2392	rundll32.exe	17
PID 2392 wrote to memory of 2180	2392	rundll32.exe	17
PID 2392 wrote to memory of 2180	2392	rundll32.exe	17
PID 2392 wrote to memory of 2180	2392	rundll32.exe	17
PID 2392 wrote to memory of 2180	2392	rundll32.exe	17
PID 2392 wrote to memory of 2180	2392	rundll32.exe	17
PID 2392 wrote to memory of 2180	2392	rundll32.exe	17
PID 2180 wrote to memory of 2988	2180	rundll32.exe	20
PID 2180 wrote to memory of 2988	2180	rundll32.exe	20
PID 2180 wrote to memory of 2988	2180	rundll32.exe	20
PID 2180 wrote to memory of 2988	2180	rundll32.exe	20

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\13663c5d59d861a64e0a2c7508e3c46d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\13663c5d59d861a64e0a2c7508e3c46d.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 224
    3⤵
    - Program crash
    PID:2988