0da3f767d3c2855bc74c3927e657e243b7daad2af75778490d57d5039f040732

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 09:17

Target

531ee4e812d813d70d3ebc769236c654.dll
Size

8KB
MD5

531ee4e812d813d70d3ebc769236c654
SHA1

2b18eed370be4367bce8d7ac5bd1a037a5e153f4
SHA256

0da3f767d3c2855bc74c3927e657e243b7daad2af75778490d57d5039f040732
SHA512

1273d57892076afc5cab52b2612dd0f8e8d6f6f9aa3731a975b4a6a375c784eb0956b014ef98deeb56686f032a4a1435cb73f65c90ba451ee45740652e5cbf13
SSDEEP

48:i5GU3XFwDacUAfb5fqVp4g7sxu68ApJ9jf83HMohCtQ:6Fpvo5y/7QIAvhfsHMow

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2340	1708	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 1708	1868	rundll32.exe	28
PID 1868 wrote to memory of 1708	1868	rundll32.exe	28
PID 1868 wrote to memory of 1708	1868	rundll32.exe	28
PID 1868 wrote to memory of 1708	1868	rundll32.exe	28
PID 1868 wrote to memory of 1708	1868	rundll32.exe	28
PID 1868 wrote to memory of 1708	1868	rundll32.exe	28
PID 1868 wrote to memory of 1708	1868	rundll32.exe	28
PID 1708 wrote to memory of 2340	1708	rundll32.exe	29
PID 1708 wrote to memory of 2340	1708	rundll32.exe	29
PID 1708 wrote to memory of 2340	1708	rundll32.exe	29
PID 1708 wrote to memory of 2340	1708	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\531ee4e812d813d70d3ebc769236c654.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\531ee4e812d813d70d3ebc769236c654.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 228
    3⤵
    - Program crash
    PID:2340