95810f2dbc80c98fbf5726ec54cea283379608b46b96982b078c11db1784399c

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 00:58

Target

094d84f9b372b6fefe60f0a65e2f04ea.dll
Size

115KB
MD5

094d84f9b372b6fefe60f0a65e2f04ea
SHA1

49e33f45d20ca49a2bbcecf9c8c831176aa71e94
SHA256

95810f2dbc80c98fbf5726ec54cea283379608b46b96982b078c11db1784399c
SHA512

5194bd3af93799ea12f8373c1bfce59cabc80fffd2cd19d0062d1b56c08f9161c8c628b0af599ff3ae329a7886627f3f398dcdbd21496ba301445721401dce76
SSDEEP

1536:mRSQ9aAOz+jMZPeERFaysktck0YDUj5DzndYCwyTVPdpKPH3zogC:mbYesWERp/Dmzd/wbPH3zog

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2632	1856	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 1856	2072	rundll32.exe	28
PID 2072 wrote to memory of 1856	2072	rundll32.exe	28
PID 2072 wrote to memory of 1856	2072	rundll32.exe	28
PID 2072 wrote to memory of 1856	2072	rundll32.exe	28
PID 2072 wrote to memory of 1856	2072	rundll32.exe	28
PID 2072 wrote to memory of 1856	2072	rundll32.exe	28
PID 2072 wrote to memory of 1856	2072	rundll32.exe	28
PID 1856 wrote to memory of 2632	1856	rundll32.exe	29
PID 1856 wrote to memory of 2632	1856	rundll32.exe	29
PID 1856 wrote to memory of 2632	1856	rundll32.exe	29
PID 1856 wrote to memory of 2632	1856	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\094d84f9b372b6fefe60f0a65e2f04ea.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\094d84f9b372b6fefe60f0a65e2f04ea.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1856
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 224
    3⤵
    - Program crash
    PID:2632