f07bf397abd8b6bed01b838c3f332319c997f810ee5ec5087e761f1ccc39641a

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14-01-2024 01:15

Target

cpfe.dll
Size

4.9MB
MD5

f0114abee0d719dee97b78058453d387
SHA1

348558256ccfc339b70ba695b7a852c188354aed
SHA256

11d8e3ca83d044d7e5595caed143fb4634ba18834aceee82963a1b80432351bf
SHA512

9d2fa6b4b73abbfdbc3ef1b4581104d684269b4f9f3a5f50bf88d5b5805903cc524453162da4672a2175ce8efeba080e11d81e8bddd995d3ebb2c47ee5851b4b
SSDEEP

98304:aXvjpr5EwEbgUq1m7tXIbbEIrOnEYojXQi59+tqK6LGC/nN9ydiGfQ/Z35WBe8h+:2/N9ydQxp61hnnCIMZpgqO4UAH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1172	1936	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1936	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 1936	1256	rundll32.exe	28
PID 1256 wrote to memory of 1936	1256	rundll32.exe	28
PID 1256 wrote to memory of 1936	1256	rundll32.exe	28
PID 1256 wrote to memory of 1936	1256	rundll32.exe	28
PID 1256 wrote to memory of 1936	1256	rundll32.exe	28
PID 1256 wrote to memory of 1936	1256	rundll32.exe	28
PID 1256 wrote to memory of 1936	1256	rundll32.exe	28
PID 1936 wrote to memory of 1172	1936	rundll32.exe	29
PID 1936 wrote to memory of 1172	1936	rundll32.exe	29
PID 1936 wrote to memory of 1172	1936	rundll32.exe	29
PID 1936 wrote to memory of 1172	1936	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cpfe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cpfe.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 224
    3⤵
    - Program crash
    PID:1172