83b1cf864bc6c51f8bb092ddfe9710b993a0df3bd61d9aa7e6ca9fb72d495bbc

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 19:20

Target

Mad.Father.v11.07.2020/Mad.Father.v11.07.2020/GuruguruSMF4.dll
Size

144KB
MD5

528ac7e063e57562df810a91d6b74cb0
SHA1

44db1d23eb183e44574bfc95b09f5853e5b8351b
SHA256

0b42d9faacb31da4c44b92dcba11434c433726ce4baad405aad21aa7807779c5
SHA512

e3d033076d14b6ca464d2bbf9c79bb53c719c43afc307d8a9e11b9a575507e1da9b1bf723493c380e8c2d271054c349fabfea7038c274d38108f0ffdeada6813
SSDEEP

1536:TXBpovdyQN3Rml4Qg1PrkYNh3rVAPE555D6EiS/ZL3wutO7srl:THL4bBtN0P86EZLTtO7s

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2456 2872 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2456	2872	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2268 wrote to memory of 2872	2268	rundll32.exe	rundll32.exe
PID 2268 wrote to memory of 2872	2268	rundll32.exe	rundll32.exe
PID 2268 wrote to memory of 2872	2268	rundll32.exe	rundll32.exe
PID 2268 wrote to memory of 2872	2268	rundll32.exe	rundll32.exe
PID 2268 wrote to memory of 2872	2268	rundll32.exe	rundll32.exe
PID 2268 wrote to memory of 2872	2268	rundll32.exe	rundll32.exe
PID 2268 wrote to memory of 2872	2268	rundll32.exe	rundll32.exe
PID 2872 wrote to memory of 2456	2872	rundll32.exe	WerFault.exe
PID 2872 wrote to memory of 2456	2872	rundll32.exe	WerFault.exe
PID 2872 wrote to memory of 2456	2872	rundll32.exe	WerFault.exe
PID 2872 wrote to memory of 2456	2872	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Mad.Father.v11.07.2020\Mad.Father.v11.07.2020\GuruguruSMF4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2268

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Mad.Father.v11.07.2020\Mad.Father.v11.07.2020\GuruguruSMF4.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 232
3⤵
- Program crash
PID:2456