c57f650774fd7efc520d4c63a387b8c6aeaa6eccd6cdbf4f32ca6696839df159

Analysis

max time kernel
142s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 16:18

Target

7c1a3ca465d8eb7488bf5a84263b82ce.dll
Size

106KB
MD5

7c1a3ca465d8eb7488bf5a84263b82ce
SHA1

e97b4e8a881778613d20acff19dfdcc4a87669de
SHA256

c57f650774fd7efc520d4c63a387b8c6aeaa6eccd6cdbf4f32ca6696839df159
SHA512

c3cf4b96e23c433b62d1b8d97a37c2d1cdeaa533010e381d1e8ba6312d557dd867710540a713b38a585c342e5f450a96dd111be0a8b929a234c4f2fb3be4b7b9
SSDEEP

1536:TjqIKDSvaTBH/FDpEfCoOe3q6o6yQKYdv5jQKuGG5naq6pFnJDYxtueV9jiH9ad:l8SvaVtpoOeZisjQKuGtDYx4wzd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2008	1104	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 1104	1516	rundll32.exe	28
PID 1516 wrote to memory of 1104	1516	rundll32.exe	28
PID 1516 wrote to memory of 1104	1516	rundll32.exe	28
PID 1516 wrote to memory of 1104	1516	rundll32.exe	28
PID 1516 wrote to memory of 1104	1516	rundll32.exe	28
PID 1516 wrote to memory of 1104	1516	rundll32.exe	28
PID 1516 wrote to memory of 1104	1516	rundll32.exe	28
PID 1104 wrote to memory of 2008	1104	rundll32.exe	29
PID 1104 wrote to memory of 2008	1104	rundll32.exe	29
PID 1104 wrote to memory of 2008	1104	rundll32.exe	29
PID 1104 wrote to memory of 2008	1104	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7c1a3ca465d8eb7488bf5a84263b82ce.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7c1a3ca465d8eb7488bf5a84263b82ce.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1104
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 236
    3⤵
    - Program crash
    PID:2008

memory/1104-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download