ffaab25bb7910b0cb315d3ddcbe83ff5b5ea94f280065595bec6c29db30cdcce

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 15:54

Target

ffaab25bb7910b0cb315d3ddcbe83ff5b5ea94f280065595bec6c29db30cdcce.dll
Size

2.6MB
MD5

ec6cbdc93d75a0879d073cef92f72507
SHA1

dc78f4a068b69b1b72ee3a6dac58d581301cd960
SHA256

ffaab25bb7910b0cb315d3ddcbe83ff5b5ea94f280065595bec6c29db30cdcce
SHA512

c4af31e58eef51837872017736f224db16465ba841d4a225996d4d73aa273a6be41df80e3b1d019ad785f3b6e86da7058617aa499aba22bf3c8da0b39797cc27
SSDEEP

49152:hFLFvOT/MSiIJlpstDJwFvJbb5FjhPVq4Q32GC6Q5DBZyIEDRH+Lm095dk:nFmT/MSiIvpstDybbLjJk4QGGC6QAIEg

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2968 1704 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2968	1704	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1664 wrote to memory of 1704	1664	rundll32.exe	rundll32.exe
PID 1664 wrote to memory of 1704	1664	rundll32.exe	rundll32.exe
PID 1664 wrote to memory of 1704	1664	rundll32.exe	rundll32.exe
PID 1664 wrote to memory of 1704	1664	rundll32.exe	rundll32.exe
PID 1664 wrote to memory of 1704	1664	rundll32.exe	rundll32.exe
PID 1664 wrote to memory of 1704	1664	rundll32.exe	rundll32.exe
PID 1664 wrote to memory of 1704	1664	rundll32.exe	rundll32.exe
PID 1704 wrote to memory of 2968	1704	rundll32.exe	WerFault.exe
PID 1704 wrote to memory of 2968	1704	rundll32.exe	WerFault.exe
PID 1704 wrote to memory of 2968	1704	rundll32.exe	WerFault.exe
PID 1704 wrote to memory of 2968	1704	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffaab25bb7910b0cb315d3ddcbe83ff5b5ea94f280065595bec6c29db30cdcce.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1664

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffaab25bb7910b0cb315d3ddcbe83ff5b5ea94f280065595bec6c29db30cdcce.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 240
3⤵
- Program crash
PID:2968