4361ea41991dfa8e6b15024b5156e02c7a866f867581b37b11ee7efaabd19790

Analysis

max time kernel
140s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 22:51

Target

4166b04c48cbb7a6cc9fe5d51940fcd6.dll
Size

1.8MB
MD5

4166b04c48cbb7a6cc9fe5d51940fcd6
SHA1

98651714195be0432b01d7fac5ab89cf878e3704
SHA256

4361ea41991dfa8e6b15024b5156e02c7a866f867581b37b11ee7efaabd19790
SHA512

69c15aefb0ea1ef66557441f27355178377977950bfc3eaf88ee5e2a5ad58f8c47bbe1511d928ac37e4c16c11091be31bd384302a5f422a0d39270e668b1004f
SSDEEP

24576:wc4tQ07Q1oHQ9X3d9QAWKCoChmlvS2jlXsPtSVF+DJ8Wk/jrhRY:wDtWP3LuoChcSkdzY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2304	1948	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 1948	1452	rundll32.exe	28
PID 1452 wrote to memory of 1948	1452	rundll32.exe	28
PID 1452 wrote to memory of 1948	1452	rundll32.exe	28
PID 1452 wrote to memory of 1948	1452	rundll32.exe	28
PID 1452 wrote to memory of 1948	1452	rundll32.exe	28
PID 1452 wrote to memory of 1948	1452	rundll32.exe	28
PID 1452 wrote to memory of 1948	1452	rundll32.exe	28
PID 1948 wrote to memory of 2304	1948	rundll32.exe	29
PID 1948 wrote to memory of 2304	1948	rundll32.exe	29
PID 1948 wrote to memory of 2304	1948	rundll32.exe	29
PID 1948 wrote to memory of 2304	1948	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4166b04c48cbb7a6cc9fe5d51940fcd6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4166b04c48cbb7a6cc9fe5d51940fcd6.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 268
    3⤵
    - Program crash
    PID:2304

memory/1948-0-0x0000000000970000-0x0000000000B42000-memory.dmp

Filesize
1.8MB

Download
memory/1948-1-0x0000000000970000-0x0000000000B42000-memory.dmp

Filesize
1.8MB

Download