719aecf90bd0b4724543bf28da6a9410dd1228bbb2b8068ba27753e927905db9

Analysis

max time kernel
122s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 09:04

Target

13c1d3533d75eaa04242171fa3c255c2.dll
Size

208KB
MD5

13c1d3533d75eaa04242171fa3c255c2
SHA1

e15a2883083a169848fae88c584c7a434c8cd836
SHA256

719aecf90bd0b4724543bf28da6a9410dd1228bbb2b8068ba27753e927905db9
SHA512

cdaad269938ddee3e171b6249dcaa8bfb2c0b6a2e20d458a6bc58aff5eba37228bd05b16a3b599d52cc5e0165669af22072f7eb0786ee87fd44fe9da3908d9bc
SSDEEP

3072:gn1hG1MrkCkyD/VJcFyaupo2yw/awYwBlUHFtwFPM:VKj/wnRwSYUYFk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2036	2144	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2144	2060	rundll32.exe	28
PID 2060 wrote to memory of 2144	2060	rundll32.exe	28
PID 2060 wrote to memory of 2144	2060	rundll32.exe	28
PID 2060 wrote to memory of 2144	2060	rundll32.exe	28
PID 2060 wrote to memory of 2144	2060	rundll32.exe	28
PID 2060 wrote to memory of 2144	2060	rundll32.exe	28
PID 2060 wrote to memory of 2144	2060	rundll32.exe	28
PID 2144 wrote to memory of 2036	2144	rundll32.exe	29
PID 2144 wrote to memory of 2036	2144	rundll32.exe	29
PID 2144 wrote to memory of 2036	2144	rundll32.exe	29
PID 2144 wrote to memory of 2036	2144	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\13c1d3533d75eaa04242171fa3c255c2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\13c1d3533d75eaa04242171fa3c255c2.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2144
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 268
    3⤵
    - Program crash
    PID:2036