fd458a3b3bd8eb56e2af627e877e11b8fb9d0d4a731e262ea0ce44f0b9586de6

Analysis

max time kernel
145s
max time network
141s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 04:08

Target
Data/DRead.dll
Size 1.6MB
Sample240605-eql18sdg3z
SHA256 bca37f7b73fa66288d432ac459a19d7fbbf4704fcf58d9854293d23709492005
MD5 b174b87339152f15e575cb23ddf2d566
SHA1 347430efbd69cd88fa167fa1ea4fedf9dd74fd44
SHA512 6eac144a505b4fb31ead01500f2d2f7e7e7a57e7821ede0b5c67ed97420138391484bb25ab5b5918db60d22c776a050dba02a1d5f8800dddaa8007c1b96f1b8b
SSDEEP 24576:1YFgxWB2C2P6R0isbrE1XN/SiBXWMzb5O9rlpIiB2SnxSN2c7apT0767CFf10BRh:16eMv5xigSgN2c7apT0767CpCTt5
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2212	1116	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1116	1728	rundll32.exe	28
PID 1728 wrote to memory of 1116	1728	rundll32.exe	28
PID 1728 wrote to memory of 1116	1728	rundll32.exe	28
PID 1728 wrote to memory of 1116	1728	rundll32.exe	28
PID 1728 wrote to memory of 1116	1728	rundll32.exe	28
PID 1728 wrote to memory of 1116	1728	rundll32.exe	28
PID 1728 wrote to memory of 1116	1728	rundll32.exe	28
PID 1116 wrote to memory of 2212	1116	rundll32.exe	29
PID 1116 wrote to memory of 2212	1116	rundll32.exe	29
PID 1116 wrote to memory of 2212	1116	rundll32.exe	29
PID 1116 wrote to memory of 2212	1116	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\DRead.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\DRead.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1116 -s 264
    3⤵
    - Program crash
    PID:2212

memory/1116-0-0x00000000008B0000-0x0000000000A59000-memory.dmp

Download

memory/1116-1-0x00000000008B0000-0x0000000000A59000-memory.dmp

Download