9c61a5a9ee42020d87d80a0591b1a7220d8f3552b5f553812a303b64b6c26452

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 23:36

Target

477543cf2a46c3ba4717106acec212d5.dll
Size

227KB
MD5

477543cf2a46c3ba4717106acec212d5
SHA1

c8ac05a1413eaa8a85bc321886060ca9fe4273a5
SHA256

9c61a5a9ee42020d87d80a0591b1a7220d8f3552b5f553812a303b64b6c26452
SHA512

116b8747436ab96e28d21340903f5adb59770bb97deb026df524a1edde3816a9cbe2ff2799c7709e85eac11a7dcb3c3122c21858874b47f2d176d0c214a70dee
SSDEEP

6144:CHfM+oQ1Bv76X/lmXn2gkbUiLlzgBpPSYQktQwv:C001Bv7o4X7kjLVmlSYX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2416	1944	WerFault.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1944	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 1944	2052	rundll32.exe	15
PID 2052 wrote to memory of 1944	2052	rundll32.exe	15
PID 2052 wrote to memory of 1944	2052	rundll32.exe	15
PID 2052 wrote to memory of 1944	2052	rundll32.exe	15
PID 2052 wrote to memory of 1944	2052	rundll32.exe	15
PID 2052 wrote to memory of 1944	2052	rundll32.exe	15
PID 2052 wrote to memory of 1944	2052	rundll32.exe	15
PID 1944 wrote to memory of 2416	1944	rundll32.exe	14
PID 1944 wrote to memory of 2416	1944	rundll32.exe	14
PID 1944 wrote to memory of 2416	1944	rundll32.exe	14
PID 1944 wrote to memory of 2416	1944	rundll32.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 292
1⤵
- Program crash
PID:2416

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\477543cf2a46c3ba4717106acec212d5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2052

memory/1944-1-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/1944-3-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/1944-2-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/1944-0-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/1944-4-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download