341f97e83e1ccfe0a11dc3211ae5d1211268ac63c9b6c2c778b3b4ae60864e55

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
25-04-2024 09:30

Target

15 Cable 4.0/INETWH32.dll
Size

48KB
MD5

08040e0bbf8ce1e9cfa7dc99affebb7f
SHA1

ff0eabff722aef85535f3fd730bae0abb1d9d51a
SHA256

4a9c61bc942fdcfcb2eec8234b04d32aca4b25c086b5b03af8bc22b3596bfe85
SHA512

4c51d4451166f659adfa43c0b4537af9716b5b2e74af7459577fe5b77a6f68051a34a13e49bc6ce6f93c0dbb7ec64c599a9d43f4e0e6a79664e3805fb7d2ebc5
SSDEEP

768:gNapYVbGZITogAr2a98SaNJfVWALlTH4DWxfWa22OZcIYYoyNFhZ9CF0htssaH:7GVb41gA/PIWgTH4DWxfWaE/Po3+tsZ

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2300 2660 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2300	2660	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2228 wrote to memory of 2660	2228	rundll32.exe	rundll32.exe
PID 2228 wrote to memory of 2660	2228	rundll32.exe	rundll32.exe
PID 2228 wrote to memory of 2660	2228	rundll32.exe	rundll32.exe
PID 2228 wrote to memory of 2660	2228	rundll32.exe	rundll32.exe
PID 2228 wrote to memory of 2660	2228	rundll32.exe	rundll32.exe
PID 2228 wrote to memory of 2660	2228	rundll32.exe	rundll32.exe
PID 2228 wrote to memory of 2660	2228	rundll32.exe	rundll32.exe
PID 2660 wrote to memory of 2300	2660	rundll32.exe	WerFault.exe
PID 2660 wrote to memory of 2300	2660	rundll32.exe	WerFault.exe
PID 2660 wrote to memory of 2300	2660	rundll32.exe	WerFault.exe
PID 2660 wrote to memory of 2300	2660	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\15 Cable 4.0\INETWH32.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2228

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\15 Cable 4.0\INETWH32.dll",#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 244
3⤵
- Program crash
PID:2300