27bf8e239f59a87c27cc9d1c7e92adece25427d246cb5c04fa0237930181fea9

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 04:47

Target

$R2/WOL/PATCHW32.dll
Size

181KB
MD5

6ec517e866e476401755281837295579
SHA1

08109c2ade310c8e345c688a6b61043967bc3ff4
SHA256

0ec6e25234ad74489eb1890d4de57bb6140bb8196bdc4a5dcac90dd9d16eb2dd
SHA512

03c250b763450033b3af3e209d82ea1b56dfea527b528d27d5328fca3846f94391628106973af96f1e7ee35ad0e96fdad36a0289ab01fbc020475301725c4d29
SSDEEP

3072:+RbF7+RecMpHaXkTamtpPb/+sF8Iu3mm3MKeQEhygkFhon8mnIFlD9PqGSuH7ayh:exCetWApTRF8Iu3mm3MaEhygkFh/mn2T

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1664	1852	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 1852	2156	rundll32.exe	28
PID 2156 wrote to memory of 1852	2156	rundll32.exe	28
PID 2156 wrote to memory of 1852	2156	rundll32.exe	28
PID 2156 wrote to memory of 1852	2156	rundll32.exe	28
PID 2156 wrote to memory of 1852	2156	rundll32.exe	28
PID 2156 wrote to memory of 1852	2156	rundll32.exe	28
PID 2156 wrote to memory of 1852	2156	rundll32.exe	28
PID 1852 wrote to memory of 1664	1852	rundll32.exe	29
PID 1852 wrote to memory of 1664	1852	rundll32.exe	29
PID 1852 wrote to memory of 1664	1852	rundll32.exe	29
PID 1852 wrote to memory of 1664	1852	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$R2\WOL\PATCHW32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$R2\WOL\PATCHW32.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1852
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 228
    3⤵
    - Program crash
    PID:1664

memory/1852-0-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download