bdb873b504db79a1c821f1c4019fc53ab5e2e55bbb629f45782ed65e1956236e

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 15:05

Target

c0f6499baf827a76b6b7a58ed92ceb45916b85180d4f858ef52f4b5ecda237b3.dll
Size

213KB
MD5

3d6e8ff8131c7bd4e50e6fc793b04358
SHA1

aad7146ff114910acb5b787045cee8c68e0e2e99
SHA256

c0f6499baf827a76b6b7a58ed92ceb45916b85180d4f858ef52f4b5ecda237b3
SHA512

cd51bb6faf961fb887a9ff72fbf7d2b12075a905384b31f02a7ac9077879f63f558d3782ce957f37492b0130c425d181037e2cb399db1ca42d01b9b80212d7d2
SSDEEP

3072:Pjh9N4a1j712h9Td2+1lxvTeZna8xUhUbT15adTWlXm:PjdFKdoSxvixTxUAoWJm

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1332	2952	WerFault.exe	29

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 2952	2900	rundll32.exe	29
PID 2900 wrote to memory of 2952	2900	rundll32.exe	29
PID 2900 wrote to memory of 2952	2900	rundll32.exe	29
PID 2900 wrote to memory of 2952	2900	rundll32.exe	29
PID 2900 wrote to memory of 2952	2900	rundll32.exe	29
PID 2900 wrote to memory of 2952	2900	rundll32.exe	29
PID 2900 wrote to memory of 2952	2900	rundll32.exe	29
PID 2952 wrote to memory of 1332	2952	rundll32.exe	30
PID 2952 wrote to memory of 1332	2952	rundll32.exe	30
PID 2952 wrote to memory of 1332	2952	rundll32.exe	30
PID 2952 wrote to memory of 1332	2952	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0f6499baf827a76b6b7a58ed92ceb45916b85180d4f858ef52f4b5ecda237b3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0f6499baf827a76b6b7a58ed92ceb45916b85180d4f858ef52f4b5ecda237b3.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 240
    3⤵
    - Program crash
    PID:1332