5617424f49f2a27dd3fa331a4fe364022055ebe7cb007033db57fea0fb1fff66

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
20-05-2024 19:17

Target

5617424f49f2a27dd3fa331a4fe364022055ebe7cb007033db57fea0fb1fff66.dll
Size

205KB
MD5

9e7fa956d833f0d2d2866201468fd1a8
SHA1

1c2964777584bc8898be70699b3bf3983f53a676
SHA256

5617424f49f2a27dd3fa331a4fe364022055ebe7cb007033db57fea0fb1fff66
SHA512

4504474c2466e687ea8da5e52c22eea863ba7587975cc0ad1ac0fc4ec69c50986ff69c0cf017e11815b62fee7ee4ed2d213ee29f56c37ed27ae3d9f9e84335cb
SSDEEP

3072:v/QPFX1eqEfuBNSYuiM8CNj8hFsoMX0ghsJRgCD3iFw9jdUAp5pf:v/MEfuN0t8C5oFsoeRM3o0jJt

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2180 2040 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2180	2040	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2404 wrote to memory of 2040	2404	rundll32.exe	rundll32.exe
PID 2404 wrote to memory of 2040	2404	rundll32.exe	rundll32.exe
PID 2404 wrote to memory of 2040	2404	rundll32.exe	rundll32.exe
PID 2404 wrote to memory of 2040	2404	rundll32.exe	rundll32.exe
PID 2404 wrote to memory of 2040	2404	rundll32.exe	rundll32.exe
PID 2404 wrote to memory of 2040	2404	rundll32.exe	rundll32.exe
PID 2404 wrote to memory of 2040	2404	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 2180	2040	rundll32.exe	WerFault.exe
PID 2040 wrote to memory of 2180	2040	rundll32.exe	WerFault.exe
PID 2040 wrote to memory of 2180	2040	rundll32.exe	WerFault.exe
PID 2040 wrote to memory of 2180	2040	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5617424f49f2a27dd3fa331a4fe364022055ebe7cb007033db57fea0fb1fff66.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2404

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5617424f49f2a27dd3fa331a4fe364022055ebe7cb007033db57fea0fb1fff66.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 228
3⤵
- Program crash
PID:2180