d43d793529aa53d452cc85badf97e5aa04fe09f61d99046c655a51b31709b624

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 03:20

Target

GenericWindowsUtils.dll
Size

11KB
MD5

896edf2c096265549fd8bb9ee23efc2c
SHA1

3c7a1dbb68afaeff2f132ca738d5cf2818b8ab13
SHA256

a3a03e816a12db0e7e4288eb00c3426a71ca7b402f623c77ad7b7f84e82b64ec
SHA512

3149931140eb9fed0d28528ce048250392897ac61f890d176ac45a4c5464b9744cebc0c0f0b69945f742835612211c059d7ebb29f8d779e0bb99cd2d8cbea56b
SSDEEP

96:9LQL4h4LJnwSpkCY3QaTVfHdVL8J8+B5o0K+3+X3+H+b+z+T+1Judcu5u+VK+/+i:5QEAZX+CY33vLkdakrSQOV+SLWNg

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1848 2260 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1848	2260	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2460 wrote to memory of 2260	2460	rundll32.exe	rundll32.exe
PID 2460 wrote to memory of 2260	2460	rundll32.exe	rundll32.exe
PID 2460 wrote to memory of 2260	2460	rundll32.exe	rundll32.exe
PID 2460 wrote to memory of 2260	2460	rundll32.exe	rundll32.exe
PID 2460 wrote to memory of 2260	2460	rundll32.exe	rundll32.exe
PID 2460 wrote to memory of 2260	2460	rundll32.exe	rundll32.exe
PID 2460 wrote to memory of 2260	2460	rundll32.exe	rundll32.exe
PID 2260 wrote to memory of 1848	2260	rundll32.exe	WerFault.exe
PID 2260 wrote to memory of 1848	2260	rundll32.exe	WerFault.exe
PID 2260 wrote to memory of 1848	2260	rundll32.exe	WerFault.exe
PID 2260 wrote to memory of 1848	2260	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GenericWindowsUtils.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2460

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GenericWindowsUtils.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 224
3⤵
- Program crash
PID:1848

memory/2260-0-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download