fd9b417e6a47214c63afcbfcc53a6771685f42119ceb1e95205f34edf0eca5d5

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/01/2024, 21:37

Target

3f16281c715dc654b4bc0852cffa1fc7.dll
Size

174KB
MD5

3f16281c715dc654b4bc0852cffa1fc7
SHA1

19627a11a7af0ec7e94c5e7090d935e26f0d24fa
SHA256

fd9b417e6a47214c63afcbfcc53a6771685f42119ceb1e95205f34edf0eca5d5
SHA512

dc7b1c417eade3fa1e55efa9963c8310dc9e9a04d47f4de98b2f7307e04f3e87f14ee109e51778ff535ff776e87ee6b8b0523387a25737f1ab45d0ef0ba19523
SSDEEP

3072:CqIQ7kpK6xN4aN2JfaRRwuypMA642dyKIh2iu2Ng/Zz:bIQ52uMGqZ+64TQ2g

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2648	2176	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 2176	2524	rundll32.exe	28
PID 2524 wrote to memory of 2176	2524	rundll32.exe	28
PID 2524 wrote to memory of 2176	2524	rundll32.exe	28
PID 2524 wrote to memory of 2176	2524	rundll32.exe	28
PID 2524 wrote to memory of 2176	2524	rundll32.exe	28
PID 2524 wrote to memory of 2176	2524	rundll32.exe	28
PID 2524 wrote to memory of 2176	2524	rundll32.exe	28
PID 2176 wrote to memory of 2648	2176	rundll32.exe	29
PID 2176 wrote to memory of 2648	2176	rundll32.exe	29
PID 2176 wrote to memory of 2648	2176	rundll32.exe	29
PID 2176 wrote to memory of 2648	2176	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f16281c715dc654b4bc0852cffa1fc7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f16281c715dc654b4bc0852cffa1fc7.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 256
    3⤵
    - Program crash
    PID:2648

memory/2176-0-0x0000000000110000-0x000000000013D000-memory.dmp

Filesize
180KB

Download
memory/2176-1-0x0000000000110000-0x000000000013D000-memory.dmp

Filesize
180KB

Download
memory/2176-2-0x0000000000110000-0x000000000013D000-memory.dmp

Filesize
180KB

Download
memory/2176-3-0x0000000000120000-0x000000000014D000-memory.dmp

Filesize
180KB

Download
memory/2176-5-0x0000000000110000-0x000000000013D000-memory.dmp

Filesize
180KB

Download
memory/2176-6-0x0000000000110000-0x000000000013D000-memory.dmp

Filesize
180KB

Download
memory/2176-4-0x0000000000110000-0x000000000013D000-memory.dmp

Filesize
180KB

Download
memory/2176-7-0x0000000000120000-0x000000000014D000-memory.dmp

Filesize
180KB

Download