234711fea01a3c2404d39b78e74a7c708aed712edd48a1ad3c0ffcb738cbb836

Analysis

max time kernel
240s
max time network
274s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 15:20

Target

28d705fa5232c37b3453c24ce842ed5d.dll
Size

389KB
MD5

28d705fa5232c37b3453c24ce842ed5d
SHA1

4378722fdca0f796da3d4e62ec81f79fb46c8ba5
SHA256

234711fea01a3c2404d39b78e74a7c708aed712edd48a1ad3c0ffcb738cbb836
SHA512

23431a9fb43d402a46e794faf15e9f3ad39dcf31bfc35774725af959526c9e470a5617796329022ec78b830bf23697eb8091ec8099b145837981fd93736c36b2
SSDEEP

6144:bFTZXSiC8EJ9iQJCG/VCZxPZug+QqajaDl2DQT0:bFTZmeQJCk0PZuf0Y0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1316	2888	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 2888	2660	rundll32.exe	27
PID 2660 wrote to memory of 2888	2660	rundll32.exe	27
PID 2660 wrote to memory of 2888	2660	rundll32.exe	27
PID 2660 wrote to memory of 2888	2660	rundll32.exe	27
PID 2660 wrote to memory of 2888	2660	rundll32.exe	27
PID 2660 wrote to memory of 2888	2660	rundll32.exe	27
PID 2660 wrote to memory of 2888	2660	rundll32.exe	27
PID 2888 wrote to memory of 1316	2888	rundll32.exe	28
PID 2888 wrote to memory of 1316	2888	rundll32.exe	28
PID 2888 wrote to memory of 1316	2888	rundll32.exe	28
PID 2888 wrote to memory of 1316	2888	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\28d705fa5232c37b3453c24ce842ed5d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\28d705fa5232c37b3453c24ce842ed5d.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 260
    3⤵
    - Program crash
    PID:1316