764e0b40d5d38e0d19a2ce2db48561b4eed43bca2d6192b30448eecd899ca4fd

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14-01-2024 02:07

Target

59ffc7f9003fa26d4f5dfad7f945a903.dll
Size

268KB
MD5

59ffc7f9003fa26d4f5dfad7f945a903
SHA1

43b802c140c5b2016bfe849acec4318c3b197882
SHA256

764e0b40d5d38e0d19a2ce2db48561b4eed43bca2d6192b30448eecd899ca4fd
SHA512

59241bad8d87d09a0ecd15a06522b003bf11cd658c2888103e01f1d31bbaba760bb6713338abd0b1938af3c838d1e72aef51e7bb2cbe822f3f4cea117f5ab444
SSDEEP

6144:0zafNZTeGSwQEzh++7yAm3fDWthY7BUcjbVS8NhinhUs3gRA:fTenqTMSt+1UcjbVTIh1QRA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2532	2492	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 2492	2052	rundll32.exe	28
PID 2052 wrote to memory of 2492	2052	rundll32.exe	28
PID 2052 wrote to memory of 2492	2052	rundll32.exe	28
PID 2052 wrote to memory of 2492	2052	rundll32.exe	28
PID 2052 wrote to memory of 2492	2052	rundll32.exe	28
PID 2052 wrote to memory of 2492	2052	rundll32.exe	28
PID 2052 wrote to memory of 2492	2052	rundll32.exe	28
PID 2492 wrote to memory of 2532	2492	rundll32.exe	29
PID 2492 wrote to memory of 2532	2492	rundll32.exe	29
PID 2492 wrote to memory of 2532	2492	rundll32.exe	29
PID 2492 wrote to memory of 2532	2492	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\59ffc7f9003fa26d4f5dfad7f945a903.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\59ffc7f9003fa26d4f5dfad7f945a903.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2492
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 256
    3⤵
    - Program crash
    PID:2532

memory/2492-1-0x0000000000710000-0x0000000000757000-memory.dmp

Filesize
284KB

Download
memory/2492-0-0x00000000001E0000-0x0000000000229000-memory.dmp

Filesize
292KB

Download
memory/2492-5-0x00000000001E0000-0x0000000000229000-memory.dmp

Filesize
292KB

Download