c3292a1a8b5708160e8d863844eb20ee0aad7ea0d827cb7bec429c70416f35cf

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 12:44

Target
lib/bin/dcpr.dll
Size 140KB
Sample240603-pypr7sgc32
SHA256 d6e172f859953f27dabd0ec0b930f76ab3e2b05caf929859c39281441591dd40
MD5 131b4a15d0a41c8346b837c8be017566
SHA1 bb16db9ad675585b8fe816e54e6fd9652e0afb62
SHA512 0b91bd259e300a73bc7accce6276ddc240b8e63fa62be9d40cdd1146b2e009c41926566dabc11044550e6e95276836bb60febb03947cec1449118531bd18e846
SSDEEP 3072:H5f+Nlo9WEoITWojGylYCE2Iu2jGLF5A9bE8LUeRBcj3:oS/omTGgYCE2L1F5A9bEGUeRC
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2864	2184	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2184	2644	rundll32.exe	28
PID 2644 wrote to memory of 2184	2644	rundll32.exe	28
PID 2644 wrote to memory of 2184	2644	rundll32.exe	28
PID 2644 wrote to memory of 2184	2644	rundll32.exe	28
PID 2644 wrote to memory of 2184	2644	rundll32.exe	28
PID 2644 wrote to memory of 2184	2644	rundll32.exe	28
PID 2644 wrote to memory of 2184	2644	rundll32.exe	28
PID 2184 wrote to memory of 2864	2184	rundll32.exe	29
PID 2184 wrote to memory of 2864	2184	rundll32.exe	29
PID 2184 wrote to memory of 2864	2184	rundll32.exe	29
PID 2184 wrote to memory of 2864	2184	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\bin\dcpr.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\bin\dcpr.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 224
    3⤵
    - Program crash
    PID:2864