79b8c2ad3cb65587585796ab02dd978f74aa9977603d62f43ec6ac2c53acbbce

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 18:12

Target
002612b0f60b3c1b8a11ecb41774cb6d.dll
Size 1.1MB
Sample231229-wthxesfghp
SHA256 79b8c2ad3cb65587585796ab02dd978f74aa9977603d62f43ec6ac2c53acbbce
MD5 002612b0f60b3c1b8a11ecb41774cb6d
SHA1 aea481a4d12de1f130c4b468fa3fe1b45abb8cdb
SHA512 93e7c8dd4b1cdc6fe99294e4680ee82b5ae3c9b4bebb181bea9c1bb4ddf57c8457237898965fb6d818480a685cff43004c4765638cbbb526f2c695c16c2d8e2c
SSDEEP 24576:a2J7VRxHcgGvQoQmN8tGqWmQd/Wjq2KcRZJxxHIfNGpPx:aWTxcCg+jq8jXxHIfwpp
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
1708	2332	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 2332	1832	rundll32.exe	15
PID 1832 wrote to memory of 2332	1832	rundll32.exe	15
PID 1832 wrote to memory of 2332	1832	rundll32.exe	15
PID 1832 wrote to memory of 2332	1832	rundll32.exe	15
PID 1832 wrote to memory of 2332	1832	rundll32.exe	15
PID 1832 wrote to memory of 2332	1832	rundll32.exe	15
PID 1832 wrote to memory of 2332	1832	rundll32.exe	15
PID 2332 wrote to memory of 1708	2332	rundll32.exe	14
PID 2332 wrote to memory of 1708	2332	rundll32.exe	14
PID 2332 wrote to memory of 1708	2332	rundll32.exe	14
PID 2332 wrote to memory of 1708	2332	rundll32.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 264
1⤵
- Program crash
PID:1708

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\002612b0f60b3c1b8a11ecb41774cb6d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2332

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\002612b0f60b3c1b8a11ecb41774cb6d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1832

memory/2332-0-0x0000000000400000-0x00000000004E3000-memory.dmp

Download