9b614decaad63e72ec4fd3bb8ee845f141e9bee2cedc4d2a1415a53f94e5d3f8

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13-02-2024 09:32

Target

9b614decaad63e72ec4fd3bb8ee845f141e9bee2cedc4d2a1415a53f94e5d3f8.dll
Size

71KB
MD5

f1d902caf562a6d43526c1d105b40ef2
SHA1

715de23dd14344245ec351b388705bef043d8f34
SHA256

9b614decaad63e72ec4fd3bb8ee845f141e9bee2cedc4d2a1415a53f94e5d3f8
SHA512

3e1bb90c48ab486b833fb3285bd4e0e07a518d04ac40480206e2893536bf1a3ee91cae62684bff08f9b08986794e4da7f9e5d4cf4fdb6960aae97de11425ce81
SSDEEP

1536:TyM3oShqE5IpzDaT0SW5PV7DxrvrgtTvRuck7qVIZOVNgS9:T33oShqE5GDaT0SW5PlDxrTgZKgIZ0NP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2180	1448	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 1448	1856	rundll32.exe	28
PID 1856 wrote to memory of 1448	1856	rundll32.exe	28
PID 1856 wrote to memory of 1448	1856	rundll32.exe	28
PID 1856 wrote to memory of 1448	1856	rundll32.exe	28
PID 1856 wrote to memory of 1448	1856	rundll32.exe	28
PID 1856 wrote to memory of 1448	1856	rundll32.exe	28
PID 1856 wrote to memory of 1448	1856	rundll32.exe	28
PID 1448 wrote to memory of 2180	1448	rundll32.exe	29
PID 1448 wrote to memory of 2180	1448	rundll32.exe	29
PID 1448 wrote to memory of 2180	1448	rundll32.exe	29
PID 1448 wrote to memory of 2180	1448	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9b614decaad63e72ec4fd3bb8ee845f141e9bee2cedc4d2a1415a53f94e5d3f8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9b614decaad63e72ec4fd3bb8ee845f141e9bee2cedc4d2a1415a53f94e5d3f8.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 224
    3⤵
    - Program crash
    PID:2180