9c0e9a27c21290673b082173211f6a79a4b44fe7cf9ce654561b97eaddf6328f

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 11:18

Target

16f6f204cb5ad036d623d2caca334fd5.dll
Size

66KB
MD5

16f6f204cb5ad036d623d2caca334fd5
SHA1

a27b8f5113e160e000e3359e1a797a91335a7748
SHA256

9c0e9a27c21290673b082173211f6a79a4b44fe7cf9ce654561b97eaddf6328f
SHA512

5a0a6faa6c55de2f276790c269589514a1b6dd2db25b957014e3282bf6f88a11f1bf790daddcec9b3bcfbe7a095f54d5894532d26e78843ab7dd3e611c511b08
SSDEEP

1536:bfq5JE9lmUsOwg2/ck06d+bgxxU9Or3Z3hhRJaQExGxVWLY:boJE9lmj90Tbyr335EOV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2180	2092	WerFault.exe	14

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2092	3032	rundll32.exe	14
PID 3032 wrote to memory of 2092	3032	rundll32.exe	14
PID 3032 wrote to memory of 2092	3032	rundll32.exe	14
PID 3032 wrote to memory of 2092	3032	rundll32.exe	14
PID 3032 wrote to memory of 2092	3032	rundll32.exe	14
PID 3032 wrote to memory of 2092	3032	rundll32.exe	14
PID 3032 wrote to memory of 2092	3032	rundll32.exe	14
PID 2092 wrote to memory of 2180	2092	rundll32.exe	29
PID 2092 wrote to memory of 2180	2092	rundll32.exe	29
PID 2092 wrote to memory of 2180	2092	rundll32.exe	29
PID 2092 wrote to memory of 2180	2092	rundll32.exe	29

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\16f6f204cb5ad036d623d2caca334fd5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 288
  2⤵
  - Program crash
  PID:2180

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\16f6f204cb5ad036d623d2caca334fd5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3032