09fe8ffbebca2853f2bba333cf95fc5f37799de83d7309c672c5e6b79615df29

Analysis

max time kernel
112s
max time network
31s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 02:05

Target

4b742fc6a6846b2792312430289a4b9e.dll
Size

432KB
MD5

4b742fc6a6846b2792312430289a4b9e
SHA1

7f8bcab29014dfcd3dab38f8d24fcd662d134d3d
SHA256

09fe8ffbebca2853f2bba333cf95fc5f37799de83d7309c672c5e6b79615df29
SHA512

fed53d8404672f858607f7e7c8cb9d4c0700e3376c16f770deeac7e7a9f8da4b22f32be8bfb773fd71bf612e9847077ac32fe8fc644353af6467068d66b069d2
SSDEEP

6144:p4/MBChuOphxRuLzytUg1BDvuVPJnZYgXM/m/WJRPShDyJW434T4xz:prB4ZphiLzyug15vuVPJBM/JAhmpaA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2888	1568	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 1568	1604	rundll32.exe	28
PID 1604 wrote to memory of 1568	1604	rundll32.exe	28
PID 1604 wrote to memory of 1568	1604	rundll32.exe	28
PID 1604 wrote to memory of 1568	1604	rundll32.exe	28
PID 1604 wrote to memory of 1568	1604	rundll32.exe	28
PID 1604 wrote to memory of 1568	1604	rundll32.exe	28
PID 1604 wrote to memory of 1568	1604	rundll32.exe	28
PID 1568 wrote to memory of 2888	1568	rundll32.exe	29
PID 1568 wrote to memory of 2888	1568	rundll32.exe	29
PID 1568 wrote to memory of 2888	1568	rundll32.exe	29
PID 1568 wrote to memory of 2888	1568	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b742fc6a6846b2792312430289a4b9e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b742fc6a6846b2792312430289a4b9e.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1568
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 256
    3⤵
    - Program crash
    PID:2888