e66d33caff1a5048e4a5b05e52de6b92957aadd9663265afe495965f9769a725

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 18:14

Target

$_2_/DuiLib.dll
Size

520KB
MD5

245800a8249bb62681ae36111ebb8c5a
SHA1

2c4ac5c2348e5842b871832e4682b277866c731a
SHA256

403d708997847a6ba5dc8191f43b1523b1250c4f1228604e880dbf3a3809ebca
SHA512

77631c8e191463b4715fcc70a9664cb67d519400f43affa53032d44ba20598d99f488160632cf22e4442fb8903ad5d7653a84983cd575ee95868ceb6b549c380
SSDEEP

6144:su0hVkZRTsr6g7Nfz+rPW2k9IjJm2EUlVK3AHzEE8JMdLwszBFFQQ5iTUQ:suggTslfzkMf2E6KwFZk4O5UQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2224	2740	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2740	2204	rundll32.exe	28
PID 2204 wrote to memory of 2740	2204	rundll32.exe	28
PID 2204 wrote to memory of 2740	2204	rundll32.exe	28
PID 2204 wrote to memory of 2740	2204	rundll32.exe	28
PID 2204 wrote to memory of 2740	2204	rundll32.exe	28
PID 2204 wrote to memory of 2740	2204	rundll32.exe	28
PID 2204 wrote to memory of 2740	2204	rundll32.exe	28
PID 2740 wrote to memory of 2224	2740	rundll32.exe	29
PID 2740 wrote to memory of 2224	2740	rundll32.exe	29
PID 2740 wrote to memory of 2224	2740	rundll32.exe	29
PID 2740 wrote to memory of 2224	2740	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_2_\DuiLib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_2_\DuiLib.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 228
    3⤵
    - Program crash
    PID:2224