291ddc36e0f58d6852b736682cdb533e20d5fed0ede563cdaa2107a9445236e9

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 10:06

Target

65fa4f1c3f77afe0f16fdd5620cc36de.dll
Size

3.6MB
MD5

65fa4f1c3f77afe0f16fdd5620cc36de
SHA1

31265dda8ff77c491762b6d3c11ac913c89e844a
SHA256

291ddc36e0f58d6852b736682cdb533e20d5fed0ede563cdaa2107a9445236e9
SHA512

f4fc628eb5e8a02216f66d81258453b66976e112a0a0211f16877188691c3f98b905d636f42fa65a8cc39ca798ec0a35dc7ec8c7e5e7a7a66cf36c457d1ae16a
SSDEEP

49152:cC0ciBETH/7qiS/1hpfEidJH+DRMpa4mIhTwazZU:cChb0hbKDReRmIT1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2740	1944	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 1944	2964	rundll32.exe	28
PID 2964 wrote to memory of 1944	2964	rundll32.exe	28
PID 2964 wrote to memory of 1944	2964	rundll32.exe	28
PID 2964 wrote to memory of 1944	2964	rundll32.exe	28
PID 2964 wrote to memory of 1944	2964	rundll32.exe	28
PID 2964 wrote to memory of 1944	2964	rundll32.exe	28
PID 2964 wrote to memory of 1944	2964	rundll32.exe	28
PID 1944 wrote to memory of 2740	1944	rundll32.exe	29
PID 1944 wrote to memory of 2740	1944	rundll32.exe	29
PID 1944 wrote to memory of 2740	1944	rundll32.exe	29
PID 1944 wrote to memory of 2740	1944	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\65fa4f1c3f77afe0f16fdd5620cc36de.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\65fa4f1c3f77afe0f16fdd5620cc36de.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 280
    3⤵
    - Program crash
    PID:2740

memory/1944-0-0x0000000002150000-0x00000000024F5000-memory.dmp

Filesize
3.6MB

Download
memory/1944-1-0x0000000002150000-0x00000000024F5000-memory.dmp

Filesize
3.6MB

Download