2a4311dc36f8b9712978a994194878079f89223c255d488074ee6e3f2d9e6331

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/01/2024, 18:45

Target

2a4311dc36f8b9712978a994194878079f89223c255d488074ee6e3f2d9e6331.dll
Size

2.6MB
MD5

4066e7c33baa1b8c659b6b7bfdb9b632
SHA1

13736be75ff76181edb27d48fab95ef0cc46ae92
SHA256

2a4311dc36f8b9712978a994194878079f89223c255d488074ee6e3f2d9e6331
SHA512

869d7305988fe382cef0c3845ab6206d04ed4da3acbe4af881e3199a13f4239ce3871dd4c35651d560befc0f1d916f3ee6ac93f2ec7e8b61a1c7376309f76cff
SSDEEP

49152:zSjFQEIivuOVUPmvbtU/M+dNSmJIVZP/rsatQanoW4nwZcHiFybwhIHl:WOEvvuOVwubt7+dtJIPHrsFanoW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2636	2176	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2176	2160	rundll32.exe	28
PID 2160 wrote to memory of 2176	2160	rundll32.exe	28
PID 2160 wrote to memory of 2176	2160	rundll32.exe	28
PID 2160 wrote to memory of 2176	2160	rundll32.exe	28
PID 2160 wrote to memory of 2176	2160	rundll32.exe	28
PID 2160 wrote to memory of 2176	2160	rundll32.exe	28
PID 2160 wrote to memory of 2176	2160	rundll32.exe	28
PID 2176 wrote to memory of 2636	2176	rundll32.exe	29
PID 2176 wrote to memory of 2636	2176	rundll32.exe	29
PID 2176 wrote to memory of 2636	2176	rundll32.exe	29
PID 2176 wrote to memory of 2636	2176	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a4311dc36f8b9712978a994194878079f89223c255d488074ee6e3f2d9e6331.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a4311dc36f8b9712978a994194878079f89223c255d488074ee6e3f2d9e6331.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 240
    3⤵
    - Program crash
    PID:2636