df6a7e61058d35963f2bc28a612eeda7a77cfd8cc5ca0a45a93e283bf97e1343

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 04:43

Target

28a9e9e996057378d14bd27ea5a9b2b5.dll
Size

19KB
MD5

28a9e9e996057378d14bd27ea5a9b2b5
SHA1

c8d0e31eaf78daf366c188ec21c0bcc3a629cc45
SHA256

df6a7e61058d35963f2bc28a612eeda7a77cfd8cc5ca0a45a93e283bf97e1343
SHA512

fdd72a9566d954085591e7fbd7c2a7ca69c7f7d150687019e19ee28ba079eee218a9623a340592c57add53d3226bf85554ef78166b224cd6fd567b4fb819ab1d
SSDEEP

384:3drkeqcgD131LO+LAAxrbH5dZPfGwip8sPa8ESaMOcuRyDdoo0uCcDK3dzTy7Mq1:tGDZZfZqj0cLJ8y7Lkc233MmoN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2660	2020	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2020	2208	rundll32.exe	28
PID 2208 wrote to memory of 2020	2208	rundll32.exe	28
PID 2208 wrote to memory of 2020	2208	rundll32.exe	28
PID 2208 wrote to memory of 2020	2208	rundll32.exe	28
PID 2208 wrote to memory of 2020	2208	rundll32.exe	28
PID 2208 wrote to memory of 2020	2208	rundll32.exe	28
PID 2208 wrote to memory of 2020	2208	rundll32.exe	28
PID 2020 wrote to memory of 2660	2020	rundll32.exe	29
PID 2020 wrote to memory of 2660	2020	rundll32.exe	29
PID 2020 wrote to memory of 2660	2020	rundll32.exe	29
PID 2020 wrote to memory of 2660	2020	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\28a9e9e996057378d14bd27ea5a9b2b5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\28a9e9e996057378d14bd27ea5a9b2b5.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 460
    3⤵
    - Program crash
    PID:2660