03849eb007d8cc569d10877ddf6d80dae5620aa0c13cbda644e0244a324afb23

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 04:00

Target

0db78fbea4906031f37d11feb1125576.dll
Size

14.9MB
MD5

0db78fbea4906031f37d11feb1125576
SHA1

e48ee087d2bb6eee326a7d2bf3d9899a54a681e2
SHA256

03849eb007d8cc569d10877ddf6d80dae5620aa0c13cbda644e0244a324afb23
SHA512

e7128b7d10e4307ccb5858846ab25f3f992aad6c07662e3021c9cc19b18852c9856bb45b3eb5f9141f281ad7af0c5b6497e431052dbe05eb3c3900b53b918226
SSDEEP

393216:+Xoyiomujym6tXoyiomujym6NXoyiomujym6tXoyiomujym6:+XonomujyJtXonomujyJNXonomujyJt4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2032	2012	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2012	2004	rundll32.exe	19
PID 2004 wrote to memory of 2012	2004	rundll32.exe	19
PID 2004 wrote to memory of 2012	2004	rundll32.exe	19
PID 2004 wrote to memory of 2012	2004	rundll32.exe	19
PID 2004 wrote to memory of 2012	2004	rundll32.exe	19
PID 2004 wrote to memory of 2012	2004	rundll32.exe	19
PID 2004 wrote to memory of 2012	2004	rundll32.exe	19
PID 2012 wrote to memory of 2032	2012	rundll32.exe	18
PID 2012 wrote to memory of 2032	2012	rundll32.exe	18
PID 2012 wrote to memory of 2032	2012	rundll32.exe	18
PID 2012 wrote to memory of 2032	2012	rundll32.exe	18

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0db78fbea4906031f37d11feb1125576.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0db78fbea4906031f37d11feb1125576.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 220
1⤵
- Program crash
PID:2032