8d679216707e488dc79e56c8c2e3f755f726e4b2a7dde24b4dd451a00fc7c664

Analysis

max time kernel
142s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-05-2024 22:18

Target

QKNM5NMWZO2OKDWPK3COLF1PKYJ8CI4BZ28.dll
Size

5.0MB
MD5

082163b6bc7a8896d535731874c8d191
SHA1

e9f1adf316f6b2afb975acd5a294b0df513fd0dd
SHA256

874ec7d6310616a24a6d31244abe030d171308ff12b6bcab3d519ce60bc5b598
SHA512

c2b3764faa5f1be5937f424eaa456e7b8a8f0c24e7f8dfe9d7275be20c12878fd3343a4fe43ee8a90784af0bc0ad6d891a73593aabe961c58ad3de6b0650f9b3
SSDEEP

49152:NSEMFRCGaY1Z5vSarGzWFV1eamZwpSiGodSKlHsh+RfqEOyLyGl2MysqPtXN3bKl:NjOCGR1L2amZwGodS3NUsveGXww

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2864 2832 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2864	2832	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2648 wrote to memory of 2832	2648	rundll32.exe	rundll32.exe
PID 2648 wrote to memory of 2832	2648	rundll32.exe	rundll32.exe
PID 2648 wrote to memory of 2832	2648	rundll32.exe	rundll32.exe
PID 2648 wrote to memory of 2832	2648	rundll32.exe	rundll32.exe
PID 2648 wrote to memory of 2832	2648	rundll32.exe	rundll32.exe
PID 2648 wrote to memory of 2832	2648	rundll32.exe	rundll32.exe
PID 2648 wrote to memory of 2832	2648	rundll32.exe	rundll32.exe
PID 2832 wrote to memory of 2864	2832	rundll32.exe	WerFault.exe
PID 2832 wrote to memory of 2864	2832	rundll32.exe	WerFault.exe
PID 2832 wrote to memory of 2864	2832	rundll32.exe	WerFault.exe
PID 2832 wrote to memory of 2864	2832	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QKNM5NMWZO2OKDWPK3COLF1PKYJ8CI4BZ28.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2648

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QKNM5NMWZO2OKDWPK3COLF1PKYJ8CI4BZ28.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 300
3⤵
- Program crash
PID:2864

memory/2832-0-0x0000000001F30000-0x00000000024C2000-memory.dmp

Filesize
5.6MB

Download
memory/2832-1-0x0000000001F30000-0x00000000024C2000-memory.dmp

Filesize
5.6MB

Download