9a906b554f5036208028b7987cc57d93c6be3ebdfbdd49b7c93f3a23ab8809ea

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 15:55

Target

9a906b554f5036208028b7987cc57d93c6be3ebdfbdd49b7c93f3a23ab8809ea.dll
Size

392KB
MD5

217466f90507d443748078554ec1a9eb
SHA1

c69a3bcd43df2d9aea9bd0c91339719b45b62046
SHA256

9a906b554f5036208028b7987cc57d93c6be3ebdfbdd49b7c93f3a23ab8809ea
SHA512

17e0ff35de839c79a928383cc8afb44bdc6f77431025eef914e39f53dc908009de6151f46d93022cc93fb919fafac9646c3dc1b0a83d96d5d6ef73492a49337e
SSDEEP

6144:F9ybA29CBT9Cul5nGXERHCkpX3afGFBxOGuoaPpZypuUb5p9TwHlM822tz:F9gAMIBikpHaEIGuoaPVUbTNwHPZ

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2152 2424 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2152	2424	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 3016 wrote to memory of 2424	3016	rundll32.exe	rundll32.exe
PID 3016 wrote to memory of 2424	3016	rundll32.exe	rundll32.exe
PID 3016 wrote to memory of 2424	3016	rundll32.exe	rundll32.exe
PID 3016 wrote to memory of 2424	3016	rundll32.exe	rundll32.exe
PID 3016 wrote to memory of 2424	3016	rundll32.exe	rundll32.exe
PID 3016 wrote to memory of 2424	3016	rundll32.exe	rundll32.exe
PID 3016 wrote to memory of 2424	3016	rundll32.exe	rundll32.exe
PID 2424 wrote to memory of 2152	2424	rundll32.exe	WerFault.exe
PID 2424 wrote to memory of 2152	2424	rundll32.exe	WerFault.exe
PID 2424 wrote to memory of 2152	2424	rundll32.exe	WerFault.exe
PID 2424 wrote to memory of 2152	2424	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a906b554f5036208028b7987cc57d93c6be3ebdfbdd49b7c93f3a23ab8809ea.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3016

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a906b554f5036208028b7987cc57d93c6be3ebdfbdd49b7c93f3a23ab8809ea.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 244
3⤵
- Program crash
PID:2152