a06ddd99f98cb9e024319b28cdda567fd86734d88a1ebfa95a43c944191f02a6

Analysis

max time kernel
141s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 06:22

Target

b40149f79cb6749efcfd8dedf281351c.dll
Size

45KB
MD5

b40149f79cb6749efcfd8dedf281351c
SHA1

61c83388045daf4b9dbde6eb1a81f5ae8a8d13f6
SHA256

a06ddd99f98cb9e024319b28cdda567fd86734d88a1ebfa95a43c944191f02a6
SHA512

00abc53fc1a1a3ea4a44489cd509b3fe7044d7416523b2507ff1d4c72700bde2d0169b98e6d242693d313cad12a44063e6db56a19d0325e2a6f0f1c2d88facfa
SSDEEP

768:oGSJm0aJlzTL1Zz8/90hAn/x37eZjQMN2Hq7XmMzaGH79wB44gk9a6gxSA5su8bM:kElzr8/9iGp37eZcMYyv9Ugk9a6g46s6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2888	2988	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2988	2740	rundll32.exe	28
PID 2740 wrote to memory of 2988	2740	rundll32.exe	28
PID 2740 wrote to memory of 2988	2740	rundll32.exe	28
PID 2740 wrote to memory of 2988	2740	rundll32.exe	28
PID 2740 wrote to memory of 2988	2740	rundll32.exe	28
PID 2740 wrote to memory of 2988	2740	rundll32.exe	28
PID 2740 wrote to memory of 2988	2740	rundll32.exe	28
PID 2988 wrote to memory of 2888	2988	rundll32.exe	29
PID 2988 wrote to memory of 2888	2988	rundll32.exe	29
PID 2988 wrote to memory of 2888	2988	rundll32.exe	29
PID 2988 wrote to memory of 2888	2988	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b40149f79cb6749efcfd8dedf281351c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b40149f79cb6749efcfd8dedf281351c.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 228
    3⤵
    - Program crash
    PID:2888

memory/2988-0-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download
memory/2988-1-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download
memory/2988-2-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download
memory/2988-3-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download
memory/2988-4-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download