b64149b93ccb89b97f0b8aa14011f157c7e3be7fef3f55bf58ed6aced19cdc95

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 15:56

Target

b64149b93ccb89b97f0b8aa14011f157c7e3be7fef3f55bf58ed6aced19cdc95.dll
Size

488KB
MD5

fc6c79baf9aadc895b60e0be7e993b31
SHA1

8a82668f76881439bd99af6eb9c99d79f7c9194b
SHA256

b64149b93ccb89b97f0b8aa14011f157c7e3be7fef3f55bf58ed6aced19cdc95
SHA512

621d710648d99ae71f68ae64adb6b4b3a1c5b0509f3d1a76b50bf5301af1adc4993143701a0c1938c5d04ea53c731f1e140d529ff2578f04b8d783ccbc46bf59
SSDEEP

12288:tV9oEWdfVZarc007v9im9ORcjdyVv42C+dm1TP9PB8UbTNwHPM8m:dMarc007v9m/SPLbTuH08

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2528 2060 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2528	2060	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 860 wrote to memory of 2060	860	rundll32.exe	rundll32.exe
PID 860 wrote to memory of 2060	860	rundll32.exe	rundll32.exe
PID 860 wrote to memory of 2060	860	rundll32.exe	rundll32.exe
PID 860 wrote to memory of 2060	860	rundll32.exe	rundll32.exe
PID 860 wrote to memory of 2060	860	rundll32.exe	rundll32.exe
PID 860 wrote to memory of 2060	860	rundll32.exe	rundll32.exe
PID 860 wrote to memory of 2060	860	rundll32.exe	rundll32.exe
PID 2060 wrote to memory of 2528	2060	rundll32.exe	WerFault.exe
PID 2060 wrote to memory of 2528	2060	rundll32.exe	WerFault.exe
PID 2060 wrote to memory of 2528	2060	rundll32.exe	WerFault.exe
PID 2060 wrote to memory of 2528	2060	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b64149b93ccb89b97f0b8aa14011f157c7e3be7fef3f55bf58ed6aced19cdc95.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:860

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b64149b93ccb89b97f0b8aa14011f157c7e3be7fef3f55bf58ed6aced19cdc95.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 252
3⤵
- Program crash
PID:2528