75f75f0449d5f42bd60d5c7a56a8ca89ff19a5d4494c95ca3fe9a11ec38438b2

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 12:26

Target

6e608885cc892eac7dc1c865e7bd6bd5.dll
Size

303KB
MD5

6e608885cc892eac7dc1c865e7bd6bd5
SHA1

bd29e9bebb9b10ed6082791c6836582344d0a464
SHA256

75f75f0449d5f42bd60d5c7a56a8ca89ff19a5d4494c95ca3fe9a11ec38438b2
SHA512

b347d4ca58e1dfcb4bdb2d764704984f877edc4fb504458e641465b5506f097db78fa8418953ec6e1baed37a1a182a405c092be85b898c19aa8183a59bd0e799
SSDEEP

6144:I6MMYx5EOhcoh//oct0pf1XB9FVTqmCYkk3jmsy6LBAOieSqsR:I3bhcoRAct0prFTHpTisHr0qc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2672	1596	WerFault.exe	28

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 1596	1684	rundll32.exe	28
PID 1684 wrote to memory of 1596	1684	rundll32.exe	28
PID 1684 wrote to memory of 1596	1684	rundll32.exe	28
PID 1684 wrote to memory of 1596	1684	rundll32.exe	28
PID 1684 wrote to memory of 1596	1684	rundll32.exe	28
PID 1684 wrote to memory of 1596	1684	rundll32.exe	28
PID 1684 wrote to memory of 1596	1684	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6e608885cc892eac7dc1c865e7bd6bd5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6e608885cc892eac7dc1c865e7bd6bd5.dll,#1
  2⤵
  PID:1596
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 196
    3⤵
    - Program crash
    PID:2672

memory/1596-0-0x0000000000220000-0x000000000022D000-memory.dmp

Filesize
52KB

Download
memory/1596-1-0x0000000010000000-0x000000001005F000-memory.dmp

Filesize
380KB

Download
memory/1596-2-0x0000000010000000-0x000000001005F000-memory.dmp

Filesize
380KB

Download