50849c1ea99cc0c86168799948525985c95d9df6f9fd05b8b8b58d1beb48e033

Analysis

max time kernel
142s
max time network
140s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/03/2024, 02:16 UTC

Target

50849c1ea99cc0c86168799948525985c95d9df6f9fd05b8b8b58d1beb48e033.dll
Size

5.8MB
MD5

0d38ed5705435ebd92c17873672cc8bc
SHA1

30994303d5df7e09a43cd65f88e25318ea210c84
SHA256

50849c1ea99cc0c86168799948525985c95d9df6f9fd05b8b8b58d1beb48e033
SHA512

36c5afbb74db616080dee11d3f0a8f1b0cf6be9e9060cdb87b483507cb7b3d5adf058df3adce2911e14d0ade11a62d025851e410bead262a866609013e2d1b75
SSDEEP

98304:5sNmCFGMyLOD8YKKKLxGGK28J3ur3dtt:5Ymrpx5L82

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3060	2872	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2872	2692	rundll32.exe	28
PID 2692 wrote to memory of 2872	2692	rundll32.exe	28
PID 2692 wrote to memory of 2872	2692	rundll32.exe	28
PID 2692 wrote to memory of 2872	2692	rundll32.exe	28
PID 2692 wrote to memory of 2872	2692	rundll32.exe	28
PID 2692 wrote to memory of 2872	2692	rundll32.exe	28
PID 2692 wrote to memory of 2872	2692	rundll32.exe	28
PID 2872 wrote to memory of 3060	2872	rundll32.exe	29
PID 2872 wrote to memory of 3060	2872	rundll32.exe	29
PID 2872 wrote to memory of 3060	2872	rundll32.exe	29
PID 2872 wrote to memory of 3060	2872	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\50849c1ea99cc0c86168799948525985c95d9df6f9fd05b8b8b58d1beb48e033.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\50849c1ea99cc0c86168799948525985c95d9df6f9fd05b8b8b58d1beb48e033.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 296
    3⤵
    - Program crash
    PID:3060

memory/2872-0-0x00000000746A0000-0x0000000074C7E000-memory.dmp

Filesize
5.9MB

Download