7ce9186373d9dbe11f1bf4715b460a87945d55451495dc7c0d609302f29da22d

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/01/2024, 02:53

Target

5a16b7035fe1e8972b177934d439643f.dll
Size

72KB
MD5

5a16b7035fe1e8972b177934d439643f
SHA1

690b69dfc5a81486d458504d3b56de1b847de5b2
SHA256

7ce9186373d9dbe11f1bf4715b460a87945d55451495dc7c0d609302f29da22d
SHA512

88bcabe098c19c2ee38e22f0b79305f9e2ce1f63d0a135d865d715453e86d59eda3204148f6b864ad6f402edc197ef30e01c9b90ff974ef1ab4891888a15fea0
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuP:C5UOq0ukgOK2l7aFQP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2284	2140	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2140	2400	rundll32.exe	28
PID 2400 wrote to memory of 2140	2400	rundll32.exe	28
PID 2400 wrote to memory of 2140	2400	rundll32.exe	28
PID 2400 wrote to memory of 2140	2400	rundll32.exe	28
PID 2400 wrote to memory of 2140	2400	rundll32.exe	28
PID 2400 wrote to memory of 2140	2400	rundll32.exe	28
PID 2400 wrote to memory of 2140	2400	rundll32.exe	28
PID 2140 wrote to memory of 2284	2140	rundll32.exe	29
PID 2140 wrote to memory of 2284	2140	rundll32.exe	29
PID 2140 wrote to memory of 2284	2140	rundll32.exe	29
PID 2140 wrote to memory of 2284	2140	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a16b7035fe1e8972b177934d439643f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a16b7035fe1e8972b177934d439643f.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 228
    3⤵
    - Program crash
    PID:2284