87ddb17301597ceaec72d42fd1e7312af7d4f8346f012344c99ad0e32fc5e5f6

Analysis

max time kernel
120s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 18:32

Target

0090215cbded16ed9ca3a3122d11abeb.dll
Size

129KB
MD5

0090215cbded16ed9ca3a3122d11abeb
SHA1

f6529b015e24743c6b82eb8fb4ad9f32727cdc77
SHA256

87ddb17301597ceaec72d42fd1e7312af7d4f8346f012344c99ad0e32fc5e5f6
SHA512

07ff99e7f1955ed9e44bcd38f2124f28a02c4d2d41666fc3ad52e014a6d8efa0d2e0899ad7176a5dbd63ee9e507c1442353b1d25028e5736473d60c359497961
SSDEEP

3072:nH4jyp58/2yZKetJ7k4vrX67kapwsZjgKk4XnMPyFYU58fucbtHk8O:H8aINtXr67RjgKks7NW3btHkd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1892	2116	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 2116	1124	rundll32.exe	27
PID 1124 wrote to memory of 2116	1124	rundll32.exe	27
PID 1124 wrote to memory of 2116	1124	rundll32.exe	27
PID 1124 wrote to memory of 2116	1124	rundll32.exe	27
PID 1124 wrote to memory of 2116	1124	rundll32.exe	27
PID 1124 wrote to memory of 2116	1124	rundll32.exe	27
PID 1124 wrote to memory of 2116	1124	rundll32.exe	27
PID 2116 wrote to memory of 1892	2116	rundll32.exe	28
PID 2116 wrote to memory of 1892	2116	rundll32.exe	28
PID 2116 wrote to memory of 1892	2116	rundll32.exe	28
PID 2116 wrote to memory of 1892	2116	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0090215cbded16ed9ca3a3122d11abeb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0090215cbded16ed9ca3a3122d11abeb.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 196
    3⤵
    - Program crash
    PID:1892

memory/2116-0-0x00000000000B0000-0x00000000000D3000-memory.dmp

Filesize
140KB

Download
memory/2116-1-0x00000000000B0000-0x00000000000D3000-memory.dmp

Filesize
140KB

Download
memory/2116-2-0x0000000000120000-0x0000000000143000-memory.dmp

Filesize
140KB

Download