21c1c5b62ceebdd74177318f5aa3818680e687012d3ca057f410825db313e2ef

Analysis

max time kernel
117s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 01:51

Target

Virussign.2024.05.18/virussign.com_0631206e87f9a6629676bd2c54c2c330.dll
Size

40KB
MD5

0631206e87f9a6629676bd2c54c2c330
SHA1

c3b4f6193c3082a74b16dcfc7751b078680ef96e
SHA256

9c0a4b81970e9f40e4114c8278462314c6b03e76803252996def4b126c8f331b
SHA512

f31a76cd87468c275c09974c26683467c7f3944d7f2b4be360aea82c6f94a33ca1491edc19b42962407006654f6c00f27a130d4812228cc3cb6fb6ad92df490d
SSDEEP

384:R06/jAw+vYUGlM7lbRfq93l+0rLyNvOppJ8nksPqXLfYjY:R0DwiYUGlUX0l+0rLkvOpKqXLf

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2592 2200 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2592	2200	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1044 wrote to memory of 2200	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 2200	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 2200	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 2200	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 2200	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 2200	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 2200	1044	rundll32.exe	rundll32.exe
PID 2200 wrote to memory of 2592	2200	rundll32.exe	WerFault.exe
PID 2200 wrote to memory of 2592	2200	rundll32.exe	WerFault.exe
PID 2200 wrote to memory of 2592	2200	rundll32.exe	WerFault.exe
PID 2200 wrote to memory of 2592	2200	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Virussign.2024.05.18\virussign.com_0631206e87f9a6629676bd2c54c2c330.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Virussign.2024.05.18\virussign.com_0631206e87f9a6629676bd2c54c2c330.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 236
    3⤵
    - Program crash
    PID:2592