a42e8ec86778f1d020d804e2bfe7033b90fc77c9f189935fc06eaa7178194768

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 15:55

Target

a42e8ec86778f1d020d804e2bfe7033b90fc77c9f189935fc06eaa7178194768.dll
Size

388KB
MD5

f0f8e19a400c63ee98832cbc0a400bd8
SHA1

d5578d232940f400e78740d76ebe8c5d6f8a70a8
SHA256

a42e8ec86778f1d020d804e2bfe7033b90fc77c9f189935fc06eaa7178194768
SHA512

98fb99d4a9fdcaf5c2579d7b294417caa4998afe21c7117131aa87ab7d40f92105286ecb76184c6dc35e86e6239a83ec96b32e54936bb4f26c08dab9e1f6fd1f
SSDEEP

6144:x8tKA6K1LxgUX5cx7/I1VWqWJ1zmvPUIpuUb5p9TwHlM82lG4:xQ1pOUpcx7/I1XMzmvPEUbTNwHPR4

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1288 848 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1288	848	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1388 wrote to memory of 848	1388	rundll32.exe	rundll32.exe
PID 1388 wrote to memory of 848	1388	rundll32.exe	rundll32.exe
PID 1388 wrote to memory of 848	1388	rundll32.exe	rundll32.exe
PID 1388 wrote to memory of 848	1388	rundll32.exe	rundll32.exe
PID 1388 wrote to memory of 848	1388	rundll32.exe	rundll32.exe
PID 1388 wrote to memory of 848	1388	rundll32.exe	rundll32.exe
PID 1388 wrote to memory of 848	1388	rundll32.exe	rundll32.exe
PID 848 wrote to memory of 1288	848	rundll32.exe	WerFault.exe
PID 848 wrote to memory of 1288	848	rundll32.exe	WerFault.exe
PID 848 wrote to memory of 1288	848	rundll32.exe	WerFault.exe
PID 848 wrote to memory of 1288	848	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a42e8ec86778f1d020d804e2bfe7033b90fc77c9f189935fc06eaa7178194768.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1388

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a42e8ec86778f1d020d804e2bfe7033b90fc77c9f189935fc06eaa7178194768.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 848 -s 244
3⤵
- Program crash
PID:1288