4a7f3286c3c67c4931d481fb63f4ddbad452079c84d374129e6afe3f2eaca088

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
11-01-2024 12:37

Target

5389a13d417bc7e9bf83c2ae13c56f08.dll
Size

16KB
MD5

5389a13d417bc7e9bf83c2ae13c56f08
SHA1

34545611dd7187265f9eebfffd4e673bf6e727dc
SHA256

4a7f3286c3c67c4931d481fb63f4ddbad452079c84d374129e6afe3f2eaca088
SHA512

607d2575f19a888364a4525643a7da79e9ff941107895f354a796a22ecde8647ad9bf654375a9f775e1b3ec27dbe69117011fa32a99c103ffc08b8070bc55797
SSDEEP

384:fZ/XwTJMrmqOSQEaib8fuBBQARQkLDOSqJeYq:fZvQnq/ZaibDBBQARQkA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1092	3008	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 3008	2932	rundll32.exe	28
PID 2932 wrote to memory of 3008	2932	rundll32.exe	28
PID 2932 wrote to memory of 3008	2932	rundll32.exe	28
PID 2932 wrote to memory of 3008	2932	rundll32.exe	28
PID 2932 wrote to memory of 3008	2932	rundll32.exe	28
PID 2932 wrote to memory of 3008	2932	rundll32.exe	28
PID 2932 wrote to memory of 3008	2932	rundll32.exe	28
PID 3008 wrote to memory of 1092	3008	rundll32.exe	29
PID 3008 wrote to memory of 1092	3008	rundll32.exe	29
PID 3008 wrote to memory of 1092	3008	rundll32.exe	29
PID 3008 wrote to memory of 1092	3008	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5389a13d417bc7e9bf83c2ae13c56f08.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5389a13d417bc7e9bf83c2ae13c56f08.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3008
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 224
    3⤵
    - Program crash
    PID:1092