d7e328a43071e5515c051cfef3911bebf5e3c4b7cfd42c4b9988a5e6d4cb12be

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 16:21

Target

b92180c63d76127643d4e56ea783abfd.dll
Size

213KB
MD5

b92180c63d76127643d4e56ea783abfd
SHA1

a6e3c619aa77b46f18b4355f72a9d57392802a46
SHA256

d7e328a43071e5515c051cfef3911bebf5e3c4b7cfd42c4b9988a5e6d4cb12be
SHA512

c42a986f85e615e49329e728060271dbb843cb7621bfdc08571e7fcffa9c0ce679eb37cb90ee1a68c6dd951829dce260e9947d944333d8c7b00805e6085a2d40
SSDEEP

6144:DaQeE+MwMEKS6Jn74Fcd5Ooh8rzo3+wJe+V:Di8wMEKS6J7Zd5OM8rzNwJBV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2668	1284	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 1284	2232	rundll32.exe	28
PID 2232 wrote to memory of 1284	2232	rundll32.exe	28
PID 2232 wrote to memory of 1284	2232	rundll32.exe	28
PID 2232 wrote to memory of 1284	2232	rundll32.exe	28
PID 2232 wrote to memory of 1284	2232	rundll32.exe	28
PID 2232 wrote to memory of 1284	2232	rundll32.exe	28
PID 2232 wrote to memory of 1284	2232	rundll32.exe	28
PID 1284 wrote to memory of 2668	1284	rundll32.exe	29
PID 1284 wrote to memory of 2668	1284	rundll32.exe	29
PID 1284 wrote to memory of 2668	1284	rundll32.exe	29
PID 1284 wrote to memory of 2668	1284	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b92180c63d76127643d4e56ea783abfd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b92180c63d76127643d4e56ea783abfd.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1284 -s 312
    3⤵
    - Program crash
    PID:2668

memory/1284-0-0x00000000001B0000-0x00000000001EE000-memory.dmp

Filesize
248KB

Download
memory/1284-1-0x00000000001B0000-0x00000000001EE000-memory.dmp

Filesize
248KB

Download
memory/1284-2-0x0000000028660000-0x000000002869E000-memory.dmp

Filesize
248KB

Download