7f6bc79dcdf6434753a273ecb3f653445028b17858b5d84bb5f16687a37e9545

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/02/2024, 06:13

Target

bin/DuiLib.dll
Size

1018KB
MD5

75881db475bef8ba732e15b4f140d53d
SHA1

10260d9c4dab6cece6f446c8786898f5d0217525
SHA256

c0d1608793012a5c2da2645802c144e010688da60ca5525f97068707fbf952c8
SHA512

22a14fc84f1a5b2de0c10b9a7e979d75b690bf067f9a255a20d66fe0ce8629c31c559d39f556de6e1c36ed2971b0c138d3dff30f723ee610bec2c339482668e6
SSDEEP

12288:eRCGCO+18Cj6SHQNYhsoGRf/1cWWl5Jc/C+SH7gnv7imjD/jt7a1nW7+Im6xb1X:e3Je86efdhic/C+SIjo9kp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1592	2308	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2308	1956	rundll32.exe	28
PID 1956 wrote to memory of 2308	1956	rundll32.exe	28
PID 1956 wrote to memory of 2308	1956	rundll32.exe	28
PID 1956 wrote to memory of 2308	1956	rundll32.exe	28
PID 1956 wrote to memory of 2308	1956	rundll32.exe	28
PID 1956 wrote to memory of 2308	1956	rundll32.exe	28
PID 1956 wrote to memory of 2308	1956	rundll32.exe	28
PID 2308 wrote to memory of 1592	2308	rundll32.exe	29
PID 2308 wrote to memory of 1592	2308	rundll32.exe	29
PID 2308 wrote to memory of 1592	2308	rundll32.exe	29
PID 2308 wrote to memory of 1592	2308	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\DuiLib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\DuiLib.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 232
    3⤵
    - Program crash
    PID:1592