2489ea0972c77ac59ee9f62eae81edcee3f289e6ae11b1f160257c14da6dc0b0

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 19:34

Target

2489ea0972c77ac59ee9f62eae81edcee3f289e6ae11b1f160257c14da6dc0b0.dll
Size

46KB
MD5

11b2b8e23834dab4f7b5e3b557966015
SHA1

c9d296f7bd18b6fba4339dc2c22a49e117b49954
SHA256

2489ea0972c77ac59ee9f62eae81edcee3f289e6ae11b1f160257c14da6dc0b0
SHA512

baf9956bcc17d387caeb60e5bbb9af68801806b5f5b107ec2b2f37c3722d6e9ec114a2c3007d2511b20232bec4b7f99854ccfa2d89fa5c05850f7c53d63e6ac4
SSDEEP

384:IOFu6OjomLJztPJcA8+qNIQhZtPnrRnJyn4:I5PUm9eBNIUX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2384	2320	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 2320	1368	rundll32.exe	28
PID 1368 wrote to memory of 2320	1368	rundll32.exe	28
PID 1368 wrote to memory of 2320	1368	rundll32.exe	28
PID 1368 wrote to memory of 2320	1368	rundll32.exe	28
PID 1368 wrote to memory of 2320	1368	rundll32.exe	28
PID 1368 wrote to memory of 2320	1368	rundll32.exe	28
PID 1368 wrote to memory of 2320	1368	rundll32.exe	28
PID 2320 wrote to memory of 2384	2320	rundll32.exe	29
PID 2320 wrote to memory of 2384	2320	rundll32.exe	29
PID 2320 wrote to memory of 2384	2320	rundll32.exe	29
PID 2320 wrote to memory of 2384	2320	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2489ea0972c77ac59ee9f62eae81edcee3f289e6ae11b1f160257c14da6dc0b0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2489ea0972c77ac59ee9f62eae81edcee3f289e6ae11b1f160257c14da6dc0b0.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 220
    3⤵
    - Program crash
    PID:2384

memory/2320-0-0x0000000061F00000-0x0000000061F0A000-memory.dmp

Filesize
40KB

Download