341a240b66dd9ff4ab13342e449ed3e7731482d40613ec35fc30e6df5bce9c29

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 18:19

Target

b8100ac7f49560c90e652a11624c08a8.dll
Size

95KB
MD5

b8100ac7f49560c90e652a11624c08a8
SHA1

6fc0d8d92a6e77d4b31cd4b6116bfa9e48585949
SHA256

341a240b66dd9ff4ab13342e449ed3e7731482d40613ec35fc30e6df5bce9c29
SHA512

9f1821912d2c35d50f94da2e7cc6c114bf611f9c86d43eb2e3181111c1171041082a463c6121842b8a6b0040b1ffc432d3cd940dc46c9bc47d2b228a75343cb2
SSDEEP

1536:iAnk4shzoW29JNYmmfAogDR2sNRSQ9YAOz+jMZPeERFaysktck0:iWqq9JNY9fZgl2sNbKesWERp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1976	1716	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 1716	1812	rundll32.exe	28
PID 1812 wrote to memory of 1716	1812	rundll32.exe	28
PID 1812 wrote to memory of 1716	1812	rundll32.exe	28
PID 1812 wrote to memory of 1716	1812	rundll32.exe	28
PID 1812 wrote to memory of 1716	1812	rundll32.exe	28
PID 1812 wrote to memory of 1716	1812	rundll32.exe	28
PID 1812 wrote to memory of 1716	1812	rundll32.exe	28
PID 1716 wrote to memory of 1976	1716	rundll32.exe	29
PID 1716 wrote to memory of 1976	1716	rundll32.exe	29
PID 1716 wrote to memory of 1976	1716	rundll32.exe	29
PID 1716 wrote to memory of 1976	1716	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b8100ac7f49560c90e652a11624c08a8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b8100ac7f49560c90e652a11624c08a8.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 228
    3⤵
    - Program crash
    PID:1976