eea89cc1c701f39bb7799588d21ca8f22441873ed0295c68a72e979fb720e67c

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 02:04

Target

3b9cb7f41b8644b22cdf13b5555bf3f0.dll
Size

234KB
MD5

3b9cb7f41b8644b22cdf13b5555bf3f0
SHA1

16041b22969f0222d3e49ead72c6d0d79c3fd787
SHA256

eea89cc1c701f39bb7799588d21ca8f22441873ed0295c68a72e979fb720e67c
SHA512

57070db60a3576d66ef4767cb6427e4c8962a0439fe7355650838c31c4014bfedd0e19e21d06a4294ebd8f334dd4c934b3d54802221a1027c044a9bfc2b6d1f8
SSDEEP

3072:RZ/uiaQH7g4RFWH2MI5e+bry7UP4yBBwwlmYe8bS7qEqnmaL+o4mWas7pIATZK4J:Rkif7gCsBIRb0UxB9l7e82OnJR4mPAo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2268	2032	WerFault.exe	15

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 2032	1364	rundll32.exe	15
PID 1364 wrote to memory of 2032	1364	rundll32.exe	15
PID 1364 wrote to memory of 2032	1364	rundll32.exe	15
PID 1364 wrote to memory of 2032	1364	rundll32.exe	15
PID 1364 wrote to memory of 2032	1364	rundll32.exe	15
PID 1364 wrote to memory of 2032	1364	rundll32.exe	15
PID 1364 wrote to memory of 2032	1364	rundll32.exe	15
PID 2032 wrote to memory of 2268	2032	rundll32.exe	29
PID 2032 wrote to memory of 2268	2032	rundll32.exe	29
PID 2032 wrote to memory of 2268	2032	rundll32.exe	29
PID 2032 wrote to memory of 2268	2032	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b9cb7f41b8644b22cdf13b5555bf3f0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b9cb7f41b8644b22cdf13b5555bf3f0.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 224
    3⤵
    - Program crash
    PID:2268

memory/2032-1-0x00000000006A0000-0x00000000006D8000-memory.dmp

Filesize
224KB

Download
memory/2032-0-0x0000000000790000-0x0000000000804000-memory.dmp

Filesize
464KB

Download
memory/2032-5-0x0000000010000000-0x0000000010074000-memory.dmp

Filesize
464KB

Download