7af2fe7bbc4462dabcb7ec51351892e55f04032f99f8b0665bffb3decf100602

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 22:56

Target

1f2864d19f05d38548145a5cad5be185.dll
Size

17KB
MD5

1f2864d19f05d38548145a5cad5be185
SHA1

bf737f9c59c0e55dd19442dae82d5e32ae889536
SHA256

7af2fe7bbc4462dabcb7ec51351892e55f04032f99f8b0665bffb3decf100602
SHA512

63761920f11c8d150b1a107d7a2eedeaaeb67801c920f4c16cf01df38227c30809876d7d31e245b7c4d0bca6384ef453f460f5828a296195e8ef22b63b315b73
SSDEEP

384:0TwfSRQb0gjf/BShKXsIh2zyluYwMv7nJMA6zy:kw2Qb0g7/sMGYwMTnJMB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1784	2880	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2880	2644	rundll32.exe	28
PID 2644 wrote to memory of 2880	2644	rundll32.exe	28
PID 2644 wrote to memory of 2880	2644	rundll32.exe	28
PID 2644 wrote to memory of 2880	2644	rundll32.exe	28
PID 2644 wrote to memory of 2880	2644	rundll32.exe	28
PID 2644 wrote to memory of 2880	2644	rundll32.exe	28
PID 2644 wrote to memory of 2880	2644	rundll32.exe	28
PID 2880 wrote to memory of 1784	2880	rundll32.exe	29
PID 2880 wrote to memory of 1784	2880	rundll32.exe	29
PID 2880 wrote to memory of 1784	2880	rundll32.exe	29
PID 2880 wrote to memory of 1784	2880	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1f2864d19f05d38548145a5cad5be185.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1f2864d19f05d38548145a5cad5be185.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2880
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 236
    3⤵
    - Program crash
    PID:1784