46c8c28b9f186929ede4971a558d4425d391e7782bcc6fcdc2c5834b5a4c98fa

Analysis

max time kernel
120s
max time network
145s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 04:24

Target

bda759ee56a0e967478b1a113041e29e.dll
Size

160KB
MD5

bda759ee56a0e967478b1a113041e29e
SHA1

c17508773c226cc6df3604edf9cbed9917d89cfe
SHA256

46c8c28b9f186929ede4971a558d4425d391e7782bcc6fcdc2c5834b5a4c98fa
SHA512

32d5825b5fbcd99255e6772a7ee787bd05ae4d6035bfae471d84c5169687ba52661831f9d00fbece240630b06021552cf8204a9e16e48f9a393407280ecebae7
SSDEEP

3072:/HHJSGMVbYElA1t3mdmGEXgMxy9Kaz8EUXSDQ/pU3WtJd2J1hh:KYfkdHEXDxy9K1EC1psk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2844	2600	WerFault.exe	29

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2600	2556	rundll32.exe	29
PID 2556 wrote to memory of 2600	2556	rundll32.exe	29
PID 2556 wrote to memory of 2600	2556	rundll32.exe	29
PID 2556 wrote to memory of 2600	2556	rundll32.exe	29
PID 2556 wrote to memory of 2600	2556	rundll32.exe	29
PID 2556 wrote to memory of 2600	2556	rundll32.exe	29
PID 2556 wrote to memory of 2600	2556	rundll32.exe	29
PID 2600 wrote to memory of 2844	2600	rundll32.exe	30
PID 2600 wrote to memory of 2844	2600	rundll32.exe	30
PID 2600 wrote to memory of 2844	2600	rundll32.exe	30
PID 2600 wrote to memory of 2844	2600	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bda759ee56a0e967478b1a113041e29e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bda759ee56a0e967478b1a113041e29e.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 240
    3⤵
    - Program crash
    PID:2844

memory/2600-0-0x00000000001C0000-0x00000000001D3000-memory.dmp

Filesize
76KB

Download
memory/2600-1-0x00000000001E0000-0x000000000020C000-memory.dmp

Filesize
176KB

Download
memory/2600-2-0x00000000001C0000-0x00000000001D3000-memory.dmp

Filesize
76KB

Download
memory/2600-6-0x00000000001C0000-0x00000000001D3000-memory.dmp

Filesize
76KB

Download