23a66b32dfa75a94036870a1dce0bfabe6b52331eb2bed02e6953b9fead97298

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 11:53

Target

clrgc.dll
Size

419KB
MD5

83561ada2482b088a381e8cbb94a3c03
SHA1

e58d58dd3191541d449a41d8e7c9d40ae55bf519
SHA256

acd770e53d74ccbc8b2e298b4991735583ecdf1827f42d5f29664e01c0000160
SHA512

0dff4e4585f5a98046581a457f23bdcb4d91ee190344a3146746299b6f538344adb7d5b7052c0d4ac8acc8efe9d37f4c90f1511db6de8bc5c2629ca4cbabb92e
SSDEEP

6144:Ve+1tRk4BTkADXyMczeMxWNhHI8mbb7RfXcFkZ6CdaOyycTYLqmdJb9oMK9+n+la:xR+ALycMxWHInZXcFkZ6YcTO9SWe+Y8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2424	2616	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 2616	1580	rundll32.exe	28
PID 1580 wrote to memory of 2616	1580	rundll32.exe	28
PID 1580 wrote to memory of 2616	1580	rundll32.exe	28
PID 1580 wrote to memory of 2616	1580	rundll32.exe	28
PID 1580 wrote to memory of 2616	1580	rundll32.exe	28
PID 1580 wrote to memory of 2616	1580	rundll32.exe	28
PID 1580 wrote to memory of 2616	1580	rundll32.exe	28
PID 2616 wrote to memory of 2424	2616	rundll32.exe	29
PID 2616 wrote to memory of 2424	2616	rundll32.exe	29
PID 2616 wrote to memory of 2424	2616	rundll32.exe	29
PID 2616 wrote to memory of 2424	2616	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\clrgc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\clrgc.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 220
    3⤵
    - Program crash
    PID:2424