4381902e014623740cf01e659fce422ad2c2ffd4dcf491be648b4b4cf4f0f7ec

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-02-2024 13:09

Target

Security.dll
Size

68KB
MD5

fe24dacc154cb537e9cb7cf08236addf
SHA1

80988974ffde0913be789687b12ababbc1cfc25f
SHA256

793f9a41e836a4700b491e4066bd2821fccac77eac7c4509c70d5f0d4fa7de36
SHA512

d1c1548d437110fa992a4734f49873786b435347281958f65635c39d081f0b5136290ab36d888c55029b5cdf56b44a0c9c67967ed875aa4f7d064a78f87e205c
SSDEEP

768:/yip5wHGO6PcWn5s2o+DyaXcGFpG8UCU2tJtKXJpFLEcinQzm1H9xllMGCV1H9xj:baGvokXcGFppUnmuJpdEFQS10107XW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2312	3044	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 3044	2296	rundll32.exe	28
PID 2296 wrote to memory of 3044	2296	rundll32.exe	28
PID 2296 wrote to memory of 3044	2296	rundll32.exe	28
PID 2296 wrote to memory of 3044	2296	rundll32.exe	28
PID 2296 wrote to memory of 3044	2296	rundll32.exe	28
PID 2296 wrote to memory of 3044	2296	rundll32.exe	28
PID 2296 wrote to memory of 3044	2296	rundll32.exe	28
PID 3044 wrote to memory of 2312	3044	rundll32.exe	29
PID 3044 wrote to memory of 2312	3044	rundll32.exe	29
PID 3044 wrote to memory of 2312	3044	rundll32.exe	29
PID 3044 wrote to memory of 2312	3044	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Security.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Security.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 228
    3⤵
    - Program crash
    PID:2312