17baafb3f9304881709f2199ad16940dae389b675582f66f37909aae279aa941

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 19:15

Target

17baafb3f9304881709f2199ad16940dae389b675582f66f37909aae279aa941.dll
Size

1.5MB
MD5

ad67ed7b852fe07b8c27817de816e82d
SHA1

c854a3c04be1750f8cfca0f4f5970d429cbbfb92
SHA256

17baafb3f9304881709f2199ad16940dae389b675582f66f37909aae279aa941
SHA512

0a6096f9205d95423949b21d225d3e0173a62f1af8520bd35813f2598d61a1a2b75aa76dcf291b911162c6c8e907f47879f20b8244bc9d21cc07f0cd01f80f1a
SSDEEP

24576:zrk1xsUP+3kKBAez9sI0hL52QW/SNez9sI0hL52QW/SZBY:bUP+FBPBsI0h1XsBsI0h1XZB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2916	1452	WerFault.exe	28

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\discord-1216883658909024366\ = "URL:Run game 1216883658909024366 protocol"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\discord-1216883658909024366\DefaultIcon	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\discord-1216883658909024366\DefaultIcon\ = "C:\\Windows\\SysWOW64\\rundll32.exe"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\discord-1216883658909024366\shell\open\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\discord-1216883658909024366\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\discord-1216883658909024366\shell\open	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\discord-1216883658909024366	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\discord-1216883658909024366\URL Protocol	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\discord-1216883658909024366\shell\open\command\ = "C:\\Windows\\SysWOW64\\rundll32.exe"	rundll32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1452	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 1452	2984	rundll32.exe	28
PID 2984 wrote to memory of 1452	2984	rundll32.exe	28
PID 2984 wrote to memory of 1452	2984	rundll32.exe	28
PID 2984 wrote to memory of 1452	2984	rundll32.exe	28
PID 2984 wrote to memory of 1452	2984	rundll32.exe	28
PID 2984 wrote to memory of 1452	2984	rundll32.exe	28
PID 2984 wrote to memory of 1452	2984	rundll32.exe	28
PID 1452 wrote to memory of 2916	1452	rundll32.exe	29
PID 1452 wrote to memory of 2916	1452	rundll32.exe	29
PID 1452 wrote to memory of 2916	1452	rundll32.exe	29
PID 1452 wrote to memory of 2916	1452	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\17baafb3f9304881709f2199ad16940dae389b675582f66f37909aae279aa941.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\17baafb3f9304881709f2199ad16940dae389b675582f66f37909aae279aa941.dll,#1
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1452
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1452 -s 252
    3⤵
    - Program crash
    PID:2916