a04c863ba82c5f2c40e76513665cca8a7977521beec91e9af9c3668ca4249f56

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
09-03-2024 18:10

Target

bc783297ba9d4c2c9a91bd5041e015dc.dll
Size

25KB
MD5

bc783297ba9d4c2c9a91bd5041e015dc
SHA1

0f9f2028872860742e820313c48efcfe1566e76b
SHA256

a04c863ba82c5f2c40e76513665cca8a7977521beec91e9af9c3668ca4249f56
SHA512

16250bc9f467ca6986e78af1da85543678a2fbe5c1fff693bf450f3c567a13a64111e4720b475c0bdeaf944a6e6cb22cc601d1a06600117708358a6e686d7d1b
SSDEEP

384:jVEjC2jVG6b4KaerLgrK5ZqP2mHxqUXYxl4SKkDWXtWsDYFJS:uZxG6b4KpQrKH+RlKliZfDYFJS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2916	2864	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2864	1740	rundll32.exe	28
PID 1740 wrote to memory of 2864	1740	rundll32.exe	28
PID 1740 wrote to memory of 2864	1740	rundll32.exe	28
PID 1740 wrote to memory of 2864	1740	rundll32.exe	28
PID 1740 wrote to memory of 2864	1740	rundll32.exe	28
PID 1740 wrote to memory of 2864	1740	rundll32.exe	28
PID 1740 wrote to memory of 2864	1740	rundll32.exe	28
PID 2864 wrote to memory of 2916	2864	rundll32.exe	29
PID 2864 wrote to memory of 2916	2864	rundll32.exe	29
PID 2864 wrote to memory of 2916	2864	rundll32.exe	29
PID 2864 wrote to memory of 2916	2864	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc783297ba9d4c2c9a91bd5041e015dc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc783297ba9d4c2c9a91bd5041e015dc.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2864 -s 240
    3⤵
    - Program crash
    PID:2916