476eed7a65001bdb3e91da3b98f0c45705dce5772ce8cf899fd02db61673df1c

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 02:55

Target

255960ef43f7473e0ce7a5e2e845b0b6.dll
Size

868KB
MD5

255960ef43f7473e0ce7a5e2e845b0b6
SHA1

dbc68bcd33eef506efbd6290e040da4011797b86
SHA256

476eed7a65001bdb3e91da3b98f0c45705dce5772ce8cf899fd02db61673df1c
SHA512

f0884bb82f4746b6cc5d0fec21547aee80ecd421e444b6135cb4e157ffd8580d1cbd5100384dcddabf6d8c70cc1f5fd0b332a77ae0ff7a0c45a7bb7577f2c219
SSDEEP

3072:oLimbdgk+DG5RZTXFd+igW88T5fC+OeMLCbM3GWRybRFufYUMxYcwFhQUA9u:Wimb6WR9Xf+igWPfJbM3abRFsmjO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2524	2496	WerFault.exe	16

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2496	2244	rundll32.exe	16
PID 2244 wrote to memory of 2496	2244	rundll32.exe	16
PID 2244 wrote to memory of 2496	2244	rundll32.exe	16
PID 2244 wrote to memory of 2496	2244	rundll32.exe	16
PID 2244 wrote to memory of 2496	2244	rundll32.exe	16
PID 2244 wrote to memory of 2496	2244	rundll32.exe	16
PID 2244 wrote to memory of 2496	2244	rundll32.exe	16
PID 2496 wrote to memory of 2524	2496	rundll32.exe	29
PID 2496 wrote to memory of 2524	2496	rundll32.exe	29
PID 2496 wrote to memory of 2524	2496	rundll32.exe	29
PID 2496 wrote to memory of 2524	2496	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\255960ef43f7473e0ce7a5e2e845b0b6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\255960ef43f7473e0ce7a5e2e845b0b6.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2496
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 260
    3⤵
    - Program crash
    PID:2524