25f838ebd48927bcc3761163a22bb1c792114eea23deca7e59562777b04ad906

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 15:52

Target

25f838ebd48927bcc3761163a22bb1c792114eea23deca7e59562777b04ad906.dll
Size

337KB
MD5

a9e125f50041e4294e703cc12d2f2379
SHA1

756344212170269290971324a3e3f61f6d92a4e2
SHA256

25f838ebd48927bcc3761163a22bb1c792114eea23deca7e59562777b04ad906
SHA512

45148a404ec18712d20daea4d5eae39ff0615cccdfa46ba0bef3e3e29dd4276507ead905c1f5e406016c25ea37b19f149994ceacc97358707399634000cf4df6
SSDEEP

3072:AM7mZAefQHEx+dTOWHT77Iwxrm9tLnhkQRw3LCms9PQMaLjzNpCnO2c+:f7mZAGAs+dTOWH/pVkiGFaLjzNp24+

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2460 1732 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2460	1732	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1572 wrote to memory of 1732	1572	rundll32.exe	rundll32.exe
PID 1572 wrote to memory of 1732	1572	rundll32.exe	rundll32.exe
PID 1572 wrote to memory of 1732	1572	rundll32.exe	rundll32.exe
PID 1572 wrote to memory of 1732	1572	rundll32.exe	rundll32.exe
PID 1572 wrote to memory of 1732	1572	rundll32.exe	rundll32.exe
PID 1572 wrote to memory of 1732	1572	rundll32.exe	rundll32.exe
PID 1572 wrote to memory of 1732	1572	rundll32.exe	rundll32.exe
PID 1732 wrote to memory of 2460	1732	rundll32.exe	WerFault.exe
PID 1732 wrote to memory of 2460	1732	rundll32.exe	WerFault.exe
PID 1732 wrote to memory of 2460	1732	rundll32.exe	WerFault.exe
PID 1732 wrote to memory of 2460	1732	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\25f838ebd48927bcc3761163a22bb1c792114eea23deca7e59562777b04ad906.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1572

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\25f838ebd48927bcc3761163a22bb1c792114eea23deca7e59562777b04ad906.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 220
3⤵
- Program crash
PID:2460