990963b648cd37c166c5b9c884d3e59b3ef75b6ead16dd7430b9580141c16811

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 08:40

Target

c570598f4f6cb21fd1a7b998215f1514.dll
Size

7.6MB
MD5

c570598f4f6cb21fd1a7b998215f1514
SHA1

1451faa92b6da243c3651ff686ac30410a3ec236
SHA256

990963b648cd37c166c5b9c884d3e59b3ef75b6ead16dd7430b9580141c16811
SHA512

8b9fcf3603371f704a79bf20de77716ec47dd42e82a6729463797528195c13b6a218b00b68520ba0fd232d0d995412b58a056db70cd5163273c6331f7bd72f43
SSDEEP

196608:HNQez+UGF216GpEifNUBUJ1hnYwMr+39RIFwacGKjv:twk6mhuUHhTMrcJacGKT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2836	2096	WerFault.exe	28

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2096	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2096	2764	rundll32.exe	28
PID 2764 wrote to memory of 2096	2764	rundll32.exe	28
PID 2764 wrote to memory of 2096	2764	rundll32.exe	28
PID 2764 wrote to memory of 2096	2764	rundll32.exe	28
PID 2764 wrote to memory of 2096	2764	rundll32.exe	28
PID 2764 wrote to memory of 2096	2764	rundll32.exe	28
PID 2764 wrote to memory of 2096	2764	rundll32.exe	28
PID 2096 wrote to memory of 2836	2096	rundll32.exe	29
PID 2096 wrote to memory of 2836	2096	rundll32.exe	29
PID 2096 wrote to memory of 2836	2096	rundll32.exe	29
PID 2096 wrote to memory of 2836	2096	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c570598f4f6cb21fd1a7b998215f1514.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c570598f4f6cb21fd1a7b998215f1514.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 308
    3⤵
    - Program crash
    PID:2836