629bf1d8fc528884217e3c10729995c98043fcfbdc916a6107f7a76361ca7256

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 06:34

Target

59e703472d7de2b38bd0146005f74e16.dll
Size

7.6MB
MD5

59e703472d7de2b38bd0146005f74e16
SHA1

d36a46fc9628d337db9d7286956c467222797be9
SHA256

629bf1d8fc528884217e3c10729995c98043fcfbdc916a6107f7a76361ca7256
SHA512

3751c2802bb589fe4a8779ded7269a84c3fdcb20409f1f0224834c97551470e3e5dfd30bb1c70687b1d6335121730cb46428825ffa67111c5d58706d641e2780
SSDEEP

196608:EcO8fB9iXvhaYE12v3b75vkAvx7NC/zK5HBbiHmUBbSd/maDOOOs:tziX5aYpkA1EWdBbiHmUBmd/mqOb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1748	1716	WerFault.exe	28

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1716	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 1716	1808	rundll32.exe	28
PID 1808 wrote to memory of 1716	1808	rundll32.exe	28
PID 1808 wrote to memory of 1716	1808	rundll32.exe	28
PID 1808 wrote to memory of 1716	1808	rundll32.exe	28
PID 1808 wrote to memory of 1716	1808	rundll32.exe	28
PID 1808 wrote to memory of 1716	1808	rundll32.exe	28
PID 1808 wrote to memory of 1716	1808	rundll32.exe	28
PID 1716 wrote to memory of 1748	1716	rundll32.exe	29
PID 1716 wrote to memory of 1748	1716	rundll32.exe	29
PID 1716 wrote to memory of 1748	1716	rundll32.exe	29
PID 1716 wrote to memory of 1748	1716	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\59e703472d7de2b38bd0146005f74e16.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\59e703472d7de2b38bd0146005f74e16.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 304
    3⤵
    - Program crash
    PID:1748