f6b0a9736d70daa74669891f58a2deafe8b3a36343beaf0fb6897d2c9104f014

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 15:58

Target

f6b0a9736d70daa74669891f58a2deafe8b3a36343beaf0fb6897d2c9104f014.dll
Size

657KB
MD5

8e8d8673bf21d21126de1a51a8f3b143
SHA1

0a74598cfd848eff16c2d107742407998bc541a7
SHA256

f6b0a9736d70daa74669891f58a2deafe8b3a36343beaf0fb6897d2c9104f014
SHA512

f6d49510d43a7c8d05cd419eb81f1a5fdae7ccdab7acaf41ce7be2db3e34123af8f344062c4c4f725977246f6cc248e1f98f43142a65a20ae5629bf288284d69
SSDEEP

12288:ivFwcQPvsHzdyqebglJ5svnpQfMQrQQRdf9javC+/7cQWnrsIZxL3DmsOQ6XGT6:0FwfPuYbA5zkQrFRuI1TVDfT6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2272	2168	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2168	2320	rundll32.exe	28
PID 2320 wrote to memory of 2168	2320	rundll32.exe	28
PID 2320 wrote to memory of 2168	2320	rundll32.exe	28
PID 2320 wrote to memory of 2168	2320	rundll32.exe	28
PID 2320 wrote to memory of 2168	2320	rundll32.exe	28
PID 2320 wrote to memory of 2168	2320	rundll32.exe	28
PID 2320 wrote to memory of 2168	2320	rundll32.exe	28
PID 2168 wrote to memory of 2272	2168	rundll32.exe	29
PID 2168 wrote to memory of 2272	2168	rundll32.exe	29
PID 2168 wrote to memory of 2272	2168	rundll32.exe	29
PID 2168 wrote to memory of 2272	2168	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f6b0a9736d70daa74669891f58a2deafe8b3a36343beaf0fb6897d2c9104f014.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f6b0a9736d70daa74669891f58a2deafe8b3a36343beaf0fb6897d2c9104f014.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 244
    3⤵
    - Program crash
    PID:2272