5686c2f009965e751062679bb038b55991bf1cab1bfd2772d90ca9e91e54617d

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 08:13

Target

114a50d49f449271807124803d476ee0.dll
Size

211KB
MD5

114a50d49f449271807124803d476ee0
SHA1

df242aacb4fd297cd53ceb4f9f7a9c52ba1423b5
SHA256

5686c2f009965e751062679bb038b55991bf1cab1bfd2772d90ca9e91e54617d
SHA512

ebd309b6cf39a12d465158fbe0a4f68624f2d1766df62490bc7967ef757bea0ac5b7633a02c9cf468f2c8be48c1e5c7d347149c7730d97dd88222b07bfdff7f5
SSDEEP

6144:SubhHset/tA0txMjSHCgw69/hJo90AC1JKclF:Bdt/tjxaSG6phJW0rScl

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2608	1912	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 1912	2232	rundll32.exe	28
PID 2232 wrote to memory of 1912	2232	rundll32.exe	28
PID 2232 wrote to memory of 1912	2232	rundll32.exe	28
PID 2232 wrote to memory of 1912	2232	rundll32.exe	28
PID 2232 wrote to memory of 1912	2232	rundll32.exe	28
PID 2232 wrote to memory of 1912	2232	rundll32.exe	28
PID 2232 wrote to memory of 1912	2232	rundll32.exe	28
PID 1912 wrote to memory of 2608	1912	rundll32.exe	29
PID 1912 wrote to memory of 2608	1912	rundll32.exe	29
PID 1912 wrote to memory of 2608	1912	rundll32.exe	29
PID 1912 wrote to memory of 2608	1912	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\114a50d49f449271807124803d476ee0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\114a50d49f449271807124803d476ee0.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 268
    3⤵
    - Program crash
    PID:2608