ec46f223709ac7e59c6b6676077507c3af36bd67712aaf9df46c7a7bddc0eddd

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 10:53

Target

a1af9567a2a8955b82cb81563a2ba1de.dll
Size

47KB
MD5

a1af9567a2a8955b82cb81563a2ba1de
SHA1

46a7387a112594c2ddcbbbab061fe8658bc42667
SHA256

ec46f223709ac7e59c6b6676077507c3af36bd67712aaf9df46c7a7bddc0eddd
SHA512

319898c2736c27901df00503c5dcdbaeca0805b0df015b4751d11f0da31273ca97f6ee5634877164deba1224e817b38d949b16c1a41fa4dc4fb2d2d2dc126ff6
SSDEEP

768:/FPKzyiNdfqNoRfrmosfFM/88eKkRagFRHRf0MFcPFR5lDA6Oi5R9/0:/9IyiNdCiRjDsFF8eKkXf0fHDAkLd0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2720	2084	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2084	2076	rundll32.exe	28
PID 2076 wrote to memory of 2084	2076	rundll32.exe	28
PID 2076 wrote to memory of 2084	2076	rundll32.exe	28
PID 2076 wrote to memory of 2084	2076	rundll32.exe	28
PID 2076 wrote to memory of 2084	2076	rundll32.exe	28
PID 2076 wrote to memory of 2084	2076	rundll32.exe	28
PID 2076 wrote to memory of 2084	2076	rundll32.exe	28
PID 2084 wrote to memory of 2720	2084	rundll32.exe	29
PID 2084 wrote to memory of 2720	2084	rundll32.exe	29
PID 2084 wrote to memory of 2720	2084	rundll32.exe	29
PID 2084 wrote to memory of 2720	2084	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1af9567a2a8955b82cb81563a2ba1de.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1af9567a2a8955b82cb81563a2ba1de.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 216
    3⤵
    - Program crash
    PID:2720

memory/2084-1-0x0000000000120000-0x000000000014A000-memory.dmp

Filesize
168KB

Download
memory/2084-2-0x0000000000110000-0x000000000013A000-memory.dmp

Filesize
168KB

Download
memory/2084-0-0x0000000000110000-0x000000000013A000-memory.dmp

Filesize
168KB

Download
memory/2084-3-0x0000000000110000-0x000000000013A000-memory.dmp

Filesize
168KB

Download
memory/2084-4-0x0000000000120000-0x000000000014A000-memory.dmp

Filesize
168KB

Download
memory/2084-5-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/2084-6-0x0000000000110000-0x000000000013A000-memory.dmp

Filesize
168KB

Download
memory/2084-7-0x0000000000110000-0x000000000013A000-memory.dmp

Filesize
168KB

Download
memory/2084-8-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download