4ef2485610a28dd8d3c67729605a1fde1e9f689f42e78c1e0dea7ce3f123c747

Analysis

max time kernel
141s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 07:32

Target

74189efcd16a1754901d85cc6e781939.dll
Size

12.8MB
MD5

74189efcd16a1754901d85cc6e781939
SHA1

c7832efbd324676497c00d7d3bf0a475fb367cb6
SHA256

4ef2485610a28dd8d3c67729605a1fde1e9f689f42e78c1e0dea7ce3f123c747
SHA512

ae19ca48b1480c4a967d11636ec9e57d6c552731a965be3e75bd4a1fb8e17176253220a12a3c86fbd610591d9123968bfa16a1473225520bf2fcb672dd525b58
SSDEEP

98304:G0vIHlJYm+wATzpDuzPYUgPjGXQOZF4R:vmhA5DuzPIjGgOH4R

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2292	2664	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2664	2184	rundll32.exe	28
PID 2184 wrote to memory of 2664	2184	rundll32.exe	28
PID 2184 wrote to memory of 2664	2184	rundll32.exe	28
PID 2184 wrote to memory of 2664	2184	rundll32.exe	28
PID 2184 wrote to memory of 2664	2184	rundll32.exe	28
PID 2184 wrote to memory of 2664	2184	rundll32.exe	28
PID 2184 wrote to memory of 2664	2184	rundll32.exe	28
PID 2664 wrote to memory of 2292	2664	rundll32.exe	29
PID 2664 wrote to memory of 2292	2664	rundll32.exe	29
PID 2664 wrote to memory of 2292	2664	rundll32.exe	29
PID 2664 wrote to memory of 2292	2664	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\74189efcd16a1754901d85cc6e781939.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\74189efcd16a1754901d85cc6e781939.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 356
    3⤵
    - Program crash
    PID:2292

memory/2664-0-0x0000000001FE0000-0x0000000002CC5000-memory.dmp

Filesize
12.9MB

Download
memory/2664-2-0x0000000001FE0000-0x0000000002CC5000-memory.dmp

Filesize
12.9MB

Download