8780514bcb63aca7fa420abc98d9c00fae38b5a50a810170c273215e9eb7f7cf

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-05-2024 23:27

Target

8780514bcb63aca7fa420abc98d9c00fae38b5a50a810170c273215e9eb7f7cf.dll
Size

237KB
MD5

b775d61a241d7c0ee823c7ede82b8d3c
SHA1

f3c8f0ed2f8d05e915ac352588440d4f0a109d72
SHA256

8780514bcb63aca7fa420abc98d9c00fae38b5a50a810170c273215e9eb7f7cf
SHA512

69515edc723c535b7b85aed082762c40546f45d8db4127bf3dc596443273f3310fa68927a41ef4da54bfe50472e72b6b7901706d5ed3205b1c8ad30c2983f181
SSDEEP

1536:Iy950zrOCuMLmgMdXtXj7EFMb26UDPH7GVDgreE:IK8rOCvmgM9Ys26UPGttE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2864	2856	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 2856	1808	rundll32.exe	28
PID 1808 wrote to memory of 2856	1808	rundll32.exe	28
PID 1808 wrote to memory of 2856	1808	rundll32.exe	28
PID 1808 wrote to memory of 2856	1808	rundll32.exe	28
PID 1808 wrote to memory of 2856	1808	rundll32.exe	28
PID 1808 wrote to memory of 2856	1808	rundll32.exe	28
PID 1808 wrote to memory of 2856	1808	rundll32.exe	28
PID 2856 wrote to memory of 2864	2856	rundll32.exe	29
PID 2856 wrote to memory of 2864	2856	rundll32.exe	29
PID 2856 wrote to memory of 2864	2856	rundll32.exe	29
PID 2856 wrote to memory of 2864	2856	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8780514bcb63aca7fa420abc98d9c00fae38b5a50a810170c273215e9eb7f7cf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8780514bcb63aca7fa420abc98d9c00fae38b5a50a810170c273215e9eb7f7cf.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 224
    3⤵
    - Program crash
    PID:2864