ba067698a42552e1f975d0c5c57ba51623c4db634ba7830a7a90bc4a219a48eb

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 19:14

Target

Debug/ipcclientcerts.dll
Size

184KB
MD5

09fbcc65bc9ea19ad51aff161900a97f
SHA1

7951dfe9b7226509c54adb98bf64869c2a164027
SHA256

d050654b9fd3d655b7b9d9c0a0a3ec43a2213bd71762a56aafbcb184b591ce32
SHA512

58ffd5741c887f6bb0602e847019bc4c51e80c2dd16ce68bef91ab648bf967b4f65cc84cc4c5d921635145b456edf85886f7685f0685f331a227e006ed2cf70c
SSDEEP

3072:ZbyyGbu6wHdyZcOMf5SZ53pKT4hd4YyOMVew2yivJvFFnlvWRCJEGBnz2Otp1ziC:ZbZAu6UdyZcOMm3wT4oKyWFnlsCJEGFh

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2572 2312 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2572	2312	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1736 wrote to memory of 2312	1736	rundll32.exe	rundll32.exe
PID 1736 wrote to memory of 2312	1736	rundll32.exe	rundll32.exe
PID 1736 wrote to memory of 2312	1736	rundll32.exe	rundll32.exe
PID 1736 wrote to memory of 2312	1736	rundll32.exe	rundll32.exe
PID 1736 wrote to memory of 2312	1736	rundll32.exe	rundll32.exe
PID 1736 wrote to memory of 2312	1736	rundll32.exe	rundll32.exe
PID 1736 wrote to memory of 2312	1736	rundll32.exe	rundll32.exe
PID 2312 wrote to memory of 2572	2312	rundll32.exe	WerFault.exe
PID 2312 wrote to memory of 2572	2312	rundll32.exe	WerFault.exe
PID 2312 wrote to memory of 2572	2312	rundll32.exe	WerFault.exe
PID 2312 wrote to memory of 2572	2312	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Debug\ipcclientcerts.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Debug\ipcclientcerts.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 220
    3⤵
    - Program crash
    PID:2572