c1a3c988a2c4b6b940f11f8c536f5a6d68035d67ce63c23893097ad076aa2260

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/01/2024, 00:38

Target

75ed708603b277e164761d6ca4077709.dll
Size

109KB
MD5

75ed708603b277e164761d6ca4077709
SHA1

1a412482b75f5a4221ec568fb8ba7e9863137b7d
SHA256

c1a3c988a2c4b6b940f11f8c536f5a6d68035d67ce63c23893097ad076aa2260
SHA512

979358571380991c81b1a111700d555056af403881c6aa121936f6f462eb55765aa23e8d979c9bcede7cca78ad351c80d86470d8d4b5999af74879cec4e1beb8
SSDEEP

1536:FhQCx49VMzMXusqSU6Vnrp862PGadbMnJ0vNF5JSvg6iIyTnWaO5VHywSF9cxQzD:BsVSsqul8wadQ0VFi2nWa4Ib9MsW7FI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2196	2992	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2992	2932	rundll32.exe	28
PID 2932 wrote to memory of 2992	2932	rundll32.exe	28
PID 2932 wrote to memory of 2992	2932	rundll32.exe	28
PID 2932 wrote to memory of 2992	2932	rundll32.exe	28
PID 2932 wrote to memory of 2992	2932	rundll32.exe	28
PID 2932 wrote to memory of 2992	2932	rundll32.exe	28
PID 2932 wrote to memory of 2992	2932	rundll32.exe	28
PID 2992 wrote to memory of 2196	2992	rundll32.exe	29
PID 2992 wrote to memory of 2196	2992	rundll32.exe	29
PID 2992 wrote to memory of 2196	2992	rundll32.exe	29
PID 2992 wrote to memory of 2196	2992	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\75ed708603b277e164761d6ca4077709.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\75ed708603b277e164761d6ca4077709.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 248
    3⤵
    - Program crash
    PID:2196

memory/2992-0-0x0000000000120000-0x000000000012F000-memory.dmp

Filesize
60KB

Download
memory/2992-2-0x0000000000190000-0x00000000001AE000-memory.dmp

Filesize
120KB

Download
memory/2992-1-0x0000000000120000-0x000000000012F000-memory.dmp

Filesize
60KB

Download
memory/2992-6-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/2992-8-0x0000000000120000-0x000000000012F000-memory.dmp

Filesize
60KB

Download