857113e1eaecdec5c2670941251b1d0745d6784c1b74f51efad72a74b6a7dbc5

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 22:25

Target

857113e1eaecdec5c2670941251b1d0745d6784c1b74f51efad72a74b6a7dbc5.dll
Size

828KB
MD5

37517fbb3d655f620a871aced0c03e73
SHA1

e498d91dc51dd14f1249c2300ea49b65fd3bace2
SHA256

857113e1eaecdec5c2670941251b1d0745d6784c1b74f51efad72a74b6a7dbc5
SHA512

e03bab8ffad428a8ea79306a334578517c547ce58923ef8cf2920b9d08ac0667d55fe2d22a4038aea4f13fa7c25d70075917000130e38580ea04846774f0ce4a
SSDEEP

12288:TT4qxZA9D36MG+fD2Ww6+Q9esqH+eMnWpy:TTpeh3xG+KWxt4Vppy

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2196 2224 WerFault.exe rundll32.exe
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

rundll32.exe

pid process

2224 rundll32.exe
2224 rundll32.exe
2224 rundll32.exe
2224 rundll32.exe
2224 rundll32.exe

pid	pid_target	process	target process
2196	2224	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1176 wrote to memory of 2224	1176	rundll32.exe	rundll32.exe
PID 1176 wrote to memory of 2224	1176	rundll32.exe	rundll32.exe
PID 1176 wrote to memory of 2224	1176	rundll32.exe	rundll32.exe
PID 1176 wrote to memory of 2224	1176	rundll32.exe	rundll32.exe
PID 1176 wrote to memory of 2224	1176	rundll32.exe	rundll32.exe
PID 1176 wrote to memory of 2224	1176	rundll32.exe	rundll32.exe
PID 1176 wrote to memory of 2224	1176	rundll32.exe	rundll32.exe
PID 2224 wrote to memory of 2196	2224	rundll32.exe	WerFault.exe
PID 2224 wrote to memory of 2196	2224	rundll32.exe	WerFault.exe
PID 2224 wrote to memory of 2196	2224	rundll32.exe	WerFault.exe
PID 2224 wrote to memory of 2196	2224	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\857113e1eaecdec5c2670941251b1d0745d6784c1b74f51efad72a74b6a7dbc5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\857113e1eaecdec5c2670941251b1d0745d6784c1b74f51efad72a74b6a7dbc5.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 296
    3⤵
    - Program crash
    PID:2196