572b3fbe6c29be35a47dfa8e78b03b7a2375fd275a06b0a137acaac1ca6de826

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 10:33

Target

572b3fbe6c29be35a47dfa8e78b03b7a2375fd275a06b0a137acaac1ca6de826.dll
Size

599KB
MD5

9ead659345e83cd4034df67a86eefecb
SHA1

2ab19842749969c633bcc1e00e988a860f7feabf
SHA256

572b3fbe6c29be35a47dfa8e78b03b7a2375fd275a06b0a137acaac1ca6de826
SHA512

6423e2de8a10a294d20fd99167408cd4e3eec628c335814c82d40486dd5cd48a56d57dbd74d42111fd2901711aa9d4bebe09d5cf873f9d231fe43f542da9ec75
SSDEEP

12288:iaDXJ2/SZqeXILbbR8m117NTInWCBK//3djiErA0knb:bYLbbP112hk39rrhkb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1028	752	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 752	1252	rundll32.exe	28
PID 1252 wrote to memory of 752	1252	rundll32.exe	28
PID 1252 wrote to memory of 752	1252	rundll32.exe	28
PID 1252 wrote to memory of 752	1252	rundll32.exe	28
PID 1252 wrote to memory of 752	1252	rundll32.exe	28
PID 1252 wrote to memory of 752	1252	rundll32.exe	28
PID 1252 wrote to memory of 752	1252	rundll32.exe	28
PID 752 wrote to memory of 1028	752	rundll32.exe	29
PID 752 wrote to memory of 1028	752	rundll32.exe	29
PID 752 wrote to memory of 1028	752	rundll32.exe	29
PID 752 wrote to memory of 1028	752	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\572b3fbe6c29be35a47dfa8e78b03b7a2375fd275a06b0a137acaac1ca6de826.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\572b3fbe6c29be35a47dfa8e78b03b7a2375fd275a06b0a137acaac1ca6de826.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:752
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 752 -s 224
    3⤵
    - Program crash
    PID:1028