57f43601d4c2810eeee86dfab7677e7d28fbbfd1a029ca3e990d3de9765646d6

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 18:19

Target

43af9f8a10482f2938a7d75ee04d3f0f2a6bbd20c575e982829f8b0d1490ba2a.dll
Size

24KB
MD5

7d324cda0b6280863373a936f1a8e571
SHA1

2ca3f28833e73ce091c046a5bacda82b37c2a55c
SHA256

43af9f8a10482f2938a7d75ee04d3f0f2a6bbd20c575e982829f8b0d1490ba2a
SHA512

090157687d1a7b765940d920d4f68233140e25ee16bb0ba5a1e9c21aa6fc5d1c43df658d947d9c399a99977f174e80de2ce4760bcd812778f815a24588ccd51c
SSDEEP

96:IJ1r0GKFi2zlJCHmyEf30fjbIN07AjbwldjWj/Qgu0xwj/KnYgqW/e4:IJ509FTxu3EfkvI1wlQkgPCj/KOW

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2408 2208 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2408	2208	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2240 wrote to memory of 2208	2240	rundll32.exe	rundll32.exe
PID 2240 wrote to memory of 2208	2240	rundll32.exe	rundll32.exe
PID 2240 wrote to memory of 2208	2240	rundll32.exe	rundll32.exe
PID 2240 wrote to memory of 2208	2240	rundll32.exe	rundll32.exe
PID 2240 wrote to memory of 2208	2240	rundll32.exe	rundll32.exe
PID 2240 wrote to memory of 2208	2240	rundll32.exe	rundll32.exe
PID 2240 wrote to memory of 2208	2240	rundll32.exe	rundll32.exe
PID 2208 wrote to memory of 2408	2208	rundll32.exe	WerFault.exe
PID 2208 wrote to memory of 2408	2208	rundll32.exe	WerFault.exe
PID 2208 wrote to memory of 2408	2208	rundll32.exe	WerFault.exe
PID 2208 wrote to memory of 2408	2208	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\43af9f8a10482f2938a7d75ee04d3f0f2a6bbd20c575e982829f8b0d1490ba2a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2240

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\43af9f8a10482f2938a7d75ee04d3f0f2a6bbd20c575e982829f8b0d1490ba2a.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 236
3⤵
- Program crash
PID:2408