8c9bc1c7a091d5a65052f249872639b3597bedba778c960241b0dbb7d87c7196

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 05:14

Target

8c9bc1c7a091d5a65052f249872639b3597bedba778c960241b0dbb7d87c7196.dll
Size

205KB
MD5

fc27ba1bf4963f5d6bb3e85f27d7f548
SHA1

15bd05d0e3f43a4ebf1ad3157b136959c9e261c3
SHA256

8c9bc1c7a091d5a65052f249872639b3597bedba778c960241b0dbb7d87c7196
SHA512

74b2728fb8df96fb815f141a9f312a1217de37833c0ab6e133754965e21b3cad1ce0419cd058cc7d3ed5583bcffc23530429019a7a39ada95d20d653c25e1672
SSDEEP

3072:v/QPFX1eqEfuBNSYuiM8CNj8hFsoMX0ghsJRgCD3iFw9jdUE5kC:v/MEfuN0t8C5oFsoeRM3o0jJ

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1824 1252 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1824	1252	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2244 wrote to memory of 1252	2244	rundll32.exe	rundll32.exe
PID 2244 wrote to memory of 1252	2244	rundll32.exe	rundll32.exe
PID 2244 wrote to memory of 1252	2244	rundll32.exe	rundll32.exe
PID 2244 wrote to memory of 1252	2244	rundll32.exe	rundll32.exe
PID 2244 wrote to memory of 1252	2244	rundll32.exe	rundll32.exe
PID 2244 wrote to memory of 1252	2244	rundll32.exe	rundll32.exe
PID 2244 wrote to memory of 1252	2244	rundll32.exe	rundll32.exe
PID 1252 wrote to memory of 1824	1252	rundll32.exe	WerFault.exe
PID 1252 wrote to memory of 1824	1252	rundll32.exe	WerFault.exe
PID 1252 wrote to memory of 1824	1252	rundll32.exe	WerFault.exe
PID 1252 wrote to memory of 1824	1252	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c9bc1c7a091d5a65052f249872639b3597bedba778c960241b0dbb7d87c7196.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2244

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c9bc1c7a091d5a65052f249872639b3597bedba778c960241b0dbb7d87c7196.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 228
3⤵
- Program crash
PID:1824