73e28ced74454351ca285f40f6e225d7d2d1bd54c67b5a16223bb5007211fee9

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 07:21

Target

be034b5f21eefb8dc8eaabcd35f612a2.dll
Size

1.9MB
MD5

be034b5f21eefb8dc8eaabcd35f612a2
SHA1

05f15790ad30fd334796a99ad2509424f881c51b
SHA256

73e28ced74454351ca285f40f6e225d7d2d1bd54c67b5a16223bb5007211fee9
SHA512

be9bf826814d315fc74d70af15ce73913c209ed9661cb5a9ffb9b1602b8e5d731c9df2b05728817b4b6256d5aff6d603ae4f9fb2db2ea72dc2badce898545459
SSDEEP

49152:Y/a794F4Tq230v1CqsHHYJmfmn+zjwQlQmo6:Yi79PAi4EfmnwcQlQY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2980	2176	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 2176	1948	rundll32.exe	28
PID 1948 wrote to memory of 2176	1948	rundll32.exe	28
PID 1948 wrote to memory of 2176	1948	rundll32.exe	28
PID 1948 wrote to memory of 2176	1948	rundll32.exe	28
PID 1948 wrote to memory of 2176	1948	rundll32.exe	28
PID 1948 wrote to memory of 2176	1948	rundll32.exe	28
PID 1948 wrote to memory of 2176	1948	rundll32.exe	28
PID 2176 wrote to memory of 2980	2176	rundll32.exe	29
PID 2176 wrote to memory of 2980	2176	rundll32.exe	29
PID 2176 wrote to memory of 2980	2176	rundll32.exe	29
PID 2176 wrote to memory of 2980	2176	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\be034b5f21eefb8dc8eaabcd35f612a2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\be034b5f21eefb8dc8eaabcd35f612a2.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 252
    3⤵
    - Program crash
    PID:2980

memory/2176-0-0x0000000001F10000-0x0000000002103000-memory.dmp

Filesize
1.9MB

Download
memory/2176-1-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/2176-2-0x0000000001F10000-0x0000000002103000-memory.dmp

Filesize
1.9MB

Download