3350745110e5423764bc65610c7e260a3ca3deff71aa6c796edfd5669bac740e

Analysis

max time kernel
141s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
17-01-2024 21:31

Target

3350745110e5423764bc65610c7e260a3ca3deff71aa6c796edfd5669bac740e.dll
Size

1.1MB
MD5

08f732c2f72777d77c286ef1a571e2a4
SHA1

7cfb77fc68c82de49d1ddf8c09abf1fb8569fa32
SHA256

3350745110e5423764bc65610c7e260a3ca3deff71aa6c796edfd5669bac740e
SHA512

387a6c8fabfd3bf288c2f2995b5941e979d6355f6daa45e03a5ca9811fbc55b898826fddc2f3c0dae7019ba2abd78cc244a1ce7efdb2a74a81e040225325a203
SSDEEP

24576:HOS9I5oYUuI85DN4t78Zro8h+h3O3IMy7EC8p:QvU80NO4My7up

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2348	1596	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1596	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 1596	1684	rundll32.exe	28
PID 1684 wrote to memory of 1596	1684	rundll32.exe	28
PID 1684 wrote to memory of 1596	1684	rundll32.exe	28
PID 1684 wrote to memory of 1596	1684	rundll32.exe	28
PID 1684 wrote to memory of 1596	1684	rundll32.exe	28
PID 1684 wrote to memory of 1596	1684	rundll32.exe	28
PID 1684 wrote to memory of 1596	1684	rundll32.exe	28
PID 1596 wrote to memory of 2348	1596	rundll32.exe	29
PID 1596 wrote to memory of 2348	1596	rundll32.exe	29
PID 1596 wrote to memory of 2348	1596	rundll32.exe	29
PID 1596 wrote to memory of 2348	1596	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3350745110e5423764bc65610c7e260a3ca3deff71aa6c796edfd5669bac740e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3350745110e5423764bc65610c7e260a3ca3deff71aa6c796edfd5669bac740e.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1596
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 256
    3⤵
    - Program crash
    PID:2348

memory/1596-0-0x0000000000780000-0x0000000000896000-memory.dmp

Filesize
1.1MB

Download
memory/1596-1-0x00000000000B0000-0x00000000000B1000-memory.dmp

Filesize
4KB

Download
memory/1596-2-0x0000000000780000-0x0000000000896000-memory.dmp

Filesize
1.1MB

Download
memory/1596-3-0x0000000000780000-0x0000000000896000-memory.dmp

Filesize
1.1MB

Download