28e3b5e25bd760ab28f0652daf21f9337287397973892b61cf0f3374fb5a1d3c

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 00:47

Target

090305209dcc33a32cb458fa0d664f5c.dll
Size

9KB
MD5

090305209dcc33a32cb458fa0d664f5c
SHA1

18ce658f5f482338696dde35304d780dd8237ea1
SHA256

28e3b5e25bd760ab28f0652daf21f9337287397973892b61cf0f3374fb5a1d3c
SHA512

edc37cf2abf0745f8d86ff67e81beeaa3b28fc0c0059ed70a20eacf24d7f6b85f1b885ec5c051a9723d304c68a317b8d31a8bd0ea5ba476a3a29d8049403870d
SSDEEP

96:q1V7dR7uwEU+hCT3GrxZ4MUtPNlz0MdG8EWvdM3IWwG34bs5:kuwEt8rsTUtPLzKNWSYWF4bs5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2412	2420	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2420	2964	rundll32.exe	28
PID 2964 wrote to memory of 2420	2964	rundll32.exe	28
PID 2964 wrote to memory of 2420	2964	rundll32.exe	28
PID 2964 wrote to memory of 2420	2964	rundll32.exe	28
PID 2964 wrote to memory of 2420	2964	rundll32.exe	28
PID 2964 wrote to memory of 2420	2964	rundll32.exe	28
PID 2964 wrote to memory of 2420	2964	rundll32.exe	28
PID 2420 wrote to memory of 2412	2420	rundll32.exe	29
PID 2420 wrote to memory of 2412	2420	rundll32.exe	29
PID 2420 wrote to memory of 2412	2420	rundll32.exe	29
PID 2420 wrote to memory of 2412	2420	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\090305209dcc33a32cb458fa0d664f5c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\090305209dcc33a32cb458fa0d664f5c.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 228
    3⤵
    - Program crash
    PID:2412

memory/2420-0-0x0000000076F90000-0x0000000076F97000-memory.dmp

Filesize
28KB

Download
memory/2420-1-0x0000000076F90000-0x0000000076F97000-memory.dmp

Filesize
28KB

Download
memory/2420-2-0x0000000076F90000-0x0000000076F97000-memory.dmp

Filesize
28KB

Download