f0b19c03d87c009ac8067440e403ac6fd386bed3f179ebe36d0ece5f2d57d5cb

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07-01-2024 12:32

Target

48fdbf2e6bafeaea718b1c8324bdc8cc.dll
Size

19KB
MD5

48fdbf2e6bafeaea718b1c8324bdc8cc
SHA1

e9e9ac4ae77459a4b42f22bcc73d6e2479513a0e
SHA256

f0b19c03d87c009ac8067440e403ac6fd386bed3f179ebe36d0ece5f2d57d5cb
SHA512

9a50c5276e4ed669d869c8d4b8873e316b1b53d485153b76ef4fe44e6181758dcfc21d02380d592833c983c27d196ea1a880432e4e501c7b3eba73ce06717c18
SSDEEP

384:ArqUAzbafjgFkiHUHdzMazuHwTadyePrr9kUTWQzQNnzQGNVCH:AeUAzbWUNQzMLwCNPvWsTzozQGPC

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msdebug.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\msdebug.dll	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1744	2100	WerFault.exe	14

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2100	rundll32.exe
2100	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2100	2932	rundll32.exe	14
PID 2932 wrote to memory of 2100	2932	rundll32.exe	14
PID 2932 wrote to memory of 2100	2932	rundll32.exe	14
PID 2932 wrote to memory of 2100	2932	rundll32.exe	14
PID 2932 wrote to memory of 2100	2932	rundll32.exe	14
PID 2932 wrote to memory of 2100	2932	rundll32.exe	14
PID 2932 wrote to memory of 2100	2932	rundll32.exe	14
PID 2100 wrote to memory of 1744	2100	rundll32.exe	17
PID 2100 wrote to memory of 1744	2100	rundll32.exe	17
PID 2100 wrote to memory of 1744	2100	rundll32.exe	17
PID 2100 wrote to memory of 1744	2100	rundll32.exe	17

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\48fdbf2e6bafeaea718b1c8324bdc8cc.dll,#1
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 224
  2⤵
  - Program crash
  PID:1744

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\48fdbf2e6bafeaea718b1c8324bdc8cc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2932

memory/2100-1-0x00000000000C0000-0x00000000000C2000-memory.dmp

Filesize
8KB

Download
memory/2100-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/2100-3-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download