d49874f5353ce132ee0b52eaf13b2ccd4feb74b215c776f8b28c7ceaaeb784fa

Analysis

max time kernel
143s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-02-2024 11:54

Target

jli.dll
Size

33.0MB
MD5

63bc5b339040c269191b17a7ea639dde
SHA1

c4dc3edddd619985e80221cc3b0980b8e422413a
SHA256

72e66a1cbe2309a0f964300bfc7a818be1b6baecda6c6581706ce1503ed8ed35
SHA512

374d0ca63918894ddb31a1d04c71e1570ca600408fe21c7ec908e3b3d5d07b6081653715543d5cc5187fe933204278340f240f6b9cfd10d20cd22cf646be9a34
SSDEEP

98304:ozoRkeRnfXwM7PF/+1yCshJhEaOtc+F/IpiMs5lpXCfqbLEr+Tz1QThMLp/3KsP7:ozQtXtbhE73W0Lp/KsPXDKg0FG

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2840 2832 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2840	2832	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2648 wrote to memory of 2832	2648	rundll32.exe	rundll32.exe
PID 2648 wrote to memory of 2832	2648	rundll32.exe	rundll32.exe
PID 2648 wrote to memory of 2832	2648	rundll32.exe	rundll32.exe
PID 2648 wrote to memory of 2832	2648	rundll32.exe	rundll32.exe
PID 2648 wrote to memory of 2832	2648	rundll32.exe	rundll32.exe
PID 2648 wrote to memory of 2832	2648	rundll32.exe	rundll32.exe
PID 2648 wrote to memory of 2832	2648	rundll32.exe	rundll32.exe
PID 2832 wrote to memory of 2840	2832	rundll32.exe	WerFault.exe
PID 2832 wrote to memory of 2840	2832	rundll32.exe	WerFault.exe
PID 2832 wrote to memory of 2840	2832	rundll32.exe	WerFault.exe
PID 2832 wrote to memory of 2840	2832	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jli.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2648

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jli.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 256
3⤵
- Program crash
PID:2840

memory/2832-0-0x000000006F9F0000-0x0000000071AF2000-memory.dmp

Filesize
33.0MB

Download