bf0ce7afa61968a7c8eb514b3b4f62a7d808c4a7954c5a2f3b4e6bc00e5f6245

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 02:38

Target

24c56dc4caf00a0cdf23e6472af7a287.dll
Size

26KB
MD5

24c56dc4caf00a0cdf23e6472af7a287
SHA1

f8d86c0cf1f638ad6703b41ae0a459acd60c7584
SHA256

bf0ce7afa61968a7c8eb514b3b4f62a7d808c4a7954c5a2f3b4e6bc00e5f6245
SHA512

38fcdae7c715d21df5c9216cd5148d1d001bab355f16ea6567f5fb4521f5e07bda31e8a3474783ab0ffa49a3b257ea38588adf30bd74c84b81d5fa0dbe145f65
SSDEEP

768:QKSYqu2R0GQjMKl/J6lzKt9jIyxmpO69:wYqu2R0GQYqXtF1x

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2996	2896	WerFault.exe	16

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 2896	1420	rundll32.exe	16
PID 1420 wrote to memory of 2896	1420	rundll32.exe	16
PID 1420 wrote to memory of 2896	1420	rundll32.exe	16
PID 1420 wrote to memory of 2896	1420	rundll32.exe	16
PID 1420 wrote to memory of 2896	1420	rundll32.exe	16
PID 1420 wrote to memory of 2896	1420	rundll32.exe	16
PID 1420 wrote to memory of 2896	1420	rundll32.exe	16
PID 2896 wrote to memory of 2996	2896	rundll32.exe	17
PID 2896 wrote to memory of 2996	2896	rundll32.exe	17
PID 2896 wrote to memory of 2996	2896	rundll32.exe	17
PID 2896 wrote to memory of 2996	2896	rundll32.exe	17

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\24c56dc4caf00a0cdf23e6472af7a287.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\24c56dc4caf00a0cdf23e6472af7a287.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 236
    3⤵
    - Program crash
    PID:2996

memory/2896-0-0x0000000000130000-0x000000000013D000-memory.dmp

Filesize
52KB

Download
memory/2896-1-0x0000000000130000-0x000000000013D000-memory.dmp

Filesize
52KB

Download