b779944b6ec7094524fa093f47c9a3849586986899d790e8956c70e6195a7159

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/03/2024, 16:10

Target

de69a72b4e091ee8666ddd1510502f46.dll
Size

40KB
MD5

de69a72b4e091ee8666ddd1510502f46
SHA1

9a5da48ef6fa37e5820d8af426ff0e98d69627da
SHA256

b779944b6ec7094524fa093f47c9a3849586986899d790e8956c70e6195a7159
SHA512

95be66afdba4843d6ed8ab99c5c20d3f0089bab8dc99a113a704a8f8be6a37921f7f0895db4dbd09d73e776858ca67acaf34f2b71ac57d51edf39f8b220dde00
SSDEEP

768:ThjyjmUUYhNWN38De/0K6mcQLhERid9DC:8mUUBmsjLhFC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2708	2060	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2060	2476	rundll32.exe	28
PID 2476 wrote to memory of 2060	2476	rundll32.exe	28
PID 2476 wrote to memory of 2060	2476	rundll32.exe	28
PID 2476 wrote to memory of 2060	2476	rundll32.exe	28
PID 2476 wrote to memory of 2060	2476	rundll32.exe	28
PID 2476 wrote to memory of 2060	2476	rundll32.exe	28
PID 2476 wrote to memory of 2060	2476	rundll32.exe	28
PID 2060 wrote to memory of 2708	2060	rundll32.exe	29
PID 2060 wrote to memory of 2708	2060	rundll32.exe	29
PID 2060 wrote to memory of 2708	2060	rundll32.exe	29
PID 2060 wrote to memory of 2708	2060	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\de69a72b4e091ee8666ddd1510502f46.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\de69a72b4e091ee8666ddd1510502f46.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 232
    3⤵
    - Program crash
    PID:2708