aad6089c3d618ac217d1404a33b2f6e6bae06a7018eee50ace16f8c5ebceecae

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 23:36

Target

0722e4e0984ad20fe02c52840a362c84.dll
Size

7.6MB
MD5

0722e4e0984ad20fe02c52840a362c84
SHA1

f59b2cd6bda5dfc0e920f3acf24dffd2d0018715
SHA256

aad6089c3d618ac217d1404a33b2f6e6bae06a7018eee50ace16f8c5ebceecae
SHA512

adce6db69ae25195f69807bef3725e2548b00f3bc2d6ad3a9367bf7a5aaacf16921873bc3476212c03f835eb50e3431caaa1e7917e316b8521d827b5470d4cf0
SSDEEP

196608:WBF1FSktimYdfz6T3Ddqd2JECvGKvDKCcwyouRwk2OGQXQxzZ:2FTSkkmYdfGdqQJEC5i5lgxzZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2216	952	WerFault.exe	15

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
952	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 952	1328	rundll32.exe	15
PID 1328 wrote to memory of 952	1328	rundll32.exe	15
PID 1328 wrote to memory of 952	1328	rundll32.exe	15
PID 1328 wrote to memory of 952	1328	rundll32.exe	15
PID 1328 wrote to memory of 952	1328	rundll32.exe	15
PID 1328 wrote to memory of 952	1328	rundll32.exe	15
PID 1328 wrote to memory of 952	1328	rundll32.exe	15
PID 952 wrote to memory of 2216	952	rundll32.exe	16
PID 952 wrote to memory of 2216	952	rundll32.exe	16
PID 952 wrote to memory of 2216	952	rundll32.exe	16
PID 952 wrote to memory of 2216	952	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0722e4e0984ad20fe02c52840a362c84.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0722e4e0984ad20fe02c52840a362c84.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 304
    3⤵
    - Program crash
    PID:2216