ffdc1369d6fa4a8cbb286fb731892fc4389f9cc5627106515f220dae95d5a4ee

Analysis

max time kernel
120s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 15:09

Target

ffdc1369d6fa4a8cbb286fb731892fc4389f9cc5627106515f220dae95d5a4ee.dll
Size

68KB
MD5

99b0a89987d3de168fcc4a0ac9ef41d6
SHA1

6632429cafb2b0f37194223169f87a51d04fa199
SHA256

ffdc1369d6fa4a8cbb286fb731892fc4389f9cc5627106515f220dae95d5a4ee
SHA512

90e33bc3c8b815bdfde7f07a6657a85e45cc70fe011fef6c813a3694d25a83883222f5e0d185fc524d90dc85a17d17790e44c4a9a0cc47d67917ab2af2829fa9
SSDEEP

1536:YNt3kRR1bdNz7s8ym9Fx/QxUOdX5kb6KFnToIfc5P7C:osXz7PZf/Q7dX5SBtTBfc5P7C

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2628	1744	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 1744	1680	rundll32.exe	28
PID 1680 wrote to memory of 1744	1680	rundll32.exe	28
PID 1680 wrote to memory of 1744	1680	rundll32.exe	28
PID 1680 wrote to memory of 1744	1680	rundll32.exe	28
PID 1680 wrote to memory of 1744	1680	rundll32.exe	28
PID 1680 wrote to memory of 1744	1680	rundll32.exe	28
PID 1680 wrote to memory of 1744	1680	rundll32.exe	28
PID 1744 wrote to memory of 2628	1744	rundll32.exe	29
PID 1744 wrote to memory of 2628	1744	rundll32.exe	29
PID 1744 wrote to memory of 2628	1744	rundll32.exe	29
PID 1744 wrote to memory of 2628	1744	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffdc1369d6fa4a8cbb286fb731892fc4389f9cc5627106515f220dae95d5a4ee.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffdc1369d6fa4a8cbb286fb731892fc4389f9cc5627106515f220dae95d5a4ee.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 232
    3⤵
    - Program crash
    PID:2628