bf9899cf48631a9ac8b75053a598dfae48753afd1901e39525bb6cd1b090771e

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 15:10

Target

d66d5cabd6c5b3cc9d5eeb4056b5eed5.dll
Size

6.2MB
MD5

d66d5cabd6c5b3cc9d5eeb4056b5eed5
SHA1

04ceb08e62d830b49d3ee18c4734c90fbfb0ee20
SHA256

bf9899cf48631a9ac8b75053a598dfae48753afd1901e39525bb6cd1b090771e
SHA512

117dc4900fad7b8953d6d879606ade23c6ed754c0e4fdb50f2a21ed705d382ed7dfcae9c73b9471b92c5f3306ba7bbfd6029b718ba129ca3fd3343e3763b70d6
SSDEEP

98304:F4aTQtpbmf4aTQtpbm94aTQtpbmT4aTQtpbm:acw1Rcw1Pcw1Fcw1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2952	2156	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 2156	2524	rundll32.exe	28
PID 2524 wrote to memory of 2156	2524	rundll32.exe	28
PID 2524 wrote to memory of 2156	2524	rundll32.exe	28
PID 2524 wrote to memory of 2156	2524	rundll32.exe	28
PID 2524 wrote to memory of 2156	2524	rundll32.exe	28
PID 2524 wrote to memory of 2156	2524	rundll32.exe	28
PID 2524 wrote to memory of 2156	2524	rundll32.exe	28
PID 2156 wrote to memory of 2952	2156	rundll32.exe	29
PID 2156 wrote to memory of 2952	2156	rundll32.exe	29
PID 2156 wrote to memory of 2952	2156	rundll32.exe	29
PID 2156 wrote to memory of 2952	2156	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d66d5cabd6c5b3cc9d5eeb4056b5eed5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d66d5cabd6c5b3cc9d5eeb4056b5eed5.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 220
    3⤵
    - Program crash
    PID:2952