c3c25a4fae27a99fc0ea801f704e5a452ac7f0f9c70f540bd52030646c61ec1d

Analysis

max time kernel
120s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 14:02

Target

c3c25a4fae27a99fc0ea801f704e5a452ac7f0f9c70f540bd52030646c61ec1d.dll
Size

63KB
MD5

562a3b73e79d6913ed270abfb71bbe9a
SHA1

2d0643382aacd65fd09b130a778a62adedf2aa4c
SHA256

c3c25a4fae27a99fc0ea801f704e5a452ac7f0f9c70f540bd52030646c61ec1d
SHA512

ce1af9dfa58167b792654e0e7f78e93fb3dc9979df8b3b9297c6f6f8fbe552aa2a4471a75f5293e8473636d89cb57f642e32b2e26dfe3fdf85e63554e1548f55
SSDEEP

1536:5Evqw7eYW6DwFv0K/vA84r9p17FnToIfdE5s8s:5cqw7eYW6UFv0K8tTBfK5s

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2716	2516	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 2516	1444	rundll32.exe	28
PID 1444 wrote to memory of 2516	1444	rundll32.exe	28
PID 1444 wrote to memory of 2516	1444	rundll32.exe	28
PID 1444 wrote to memory of 2516	1444	rundll32.exe	28
PID 1444 wrote to memory of 2516	1444	rundll32.exe	28
PID 1444 wrote to memory of 2516	1444	rundll32.exe	28
PID 1444 wrote to memory of 2516	1444	rundll32.exe	28
PID 2516 wrote to memory of 2716	2516	rundll32.exe	29
PID 2516 wrote to memory of 2716	2516	rundll32.exe	29
PID 2516 wrote to memory of 2716	2516	rundll32.exe	29
PID 2516 wrote to memory of 2716	2516	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c3c25a4fae27a99fc0ea801f704e5a452ac7f0f9c70f540bd52030646c61ec1d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c3c25a4fae27a99fc0ea801f704e5a452ac7f0f9c70f540bd52030646c61ec1d.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 232
    3⤵
    - Program crash
    PID:2716