39c3ff7cce5ed73d195ad76e2c5adc344eeaa2dae33630609586a63b5a45ff39

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 09:23

Target

6379b941dc31bd2e81e70eb9593b7ce8.dll
Size

150KB
MD5

6379b941dc31bd2e81e70eb9593b7ce8
SHA1

0277d9790dc6bd6f92c9dfb951ee6d948aeb00eb
SHA256

39c3ff7cce5ed73d195ad76e2c5adc344eeaa2dae33630609586a63b5a45ff39
SHA512

b16d99ae0415e4a2095006784de29fb224a06ef539ace99b693571e6b749795ed1264d460c6b0b9c5ce0fd05d29f7afe1cfe5df71d2fec80720620bd2b2a75dd
SSDEEP

3072:suhE6zRkNKeDHreabzkUtlan9qZTEUYZXpjjZ:suh6veacUtc3XRjZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2736	2904	WerFault.exe	16

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2904	2536	rundll32.exe	16
PID 2536 wrote to memory of 2904	2536	rundll32.exe	16
PID 2536 wrote to memory of 2904	2536	rundll32.exe	16
PID 2536 wrote to memory of 2904	2536	rundll32.exe	16
PID 2536 wrote to memory of 2904	2536	rundll32.exe	16
PID 2536 wrote to memory of 2904	2536	rundll32.exe	16
PID 2536 wrote to memory of 2904	2536	rundll32.exe	16
PID 2904 wrote to memory of 2736	2904	rundll32.exe	29
PID 2904 wrote to memory of 2736	2904	rundll32.exe	29
PID 2904 wrote to memory of 2736	2904	rundll32.exe	29
PID 2904 wrote to memory of 2736	2904	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6379b941dc31bd2e81e70eb9593b7ce8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6379b941dc31bd2e81e70eb9593b7ce8.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 260
    3⤵
    - Program crash
    PID:2736