b6d32ae916a2cfd4220c5613f3a8210cfe3c8b1ed3b66a38588891a1d1bf7aab

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09/06/2024, 07:26

Target

b6d32ae916a2cfd4220c5613f3a8210cfe3c8b1ed3b66a38588891a1d1bf7aab.dll
Size

306KB
MD5

fbe5f9f39094e1453dcd1101dc897020
SHA1

8cc91bbb6bb8902bf29d1e4a907e482c5d2e3d48
SHA256

b6d32ae916a2cfd4220c5613f3a8210cfe3c8b1ed3b66a38588891a1d1bf7aab
SHA512

38e8931359001e616beef62e63bf77994f9722e85ed1f3b1d23e3778b5d8056c1fbba64539154352a761629ed68a4b201102d610c565282bad6c1347f1f2314e
SSDEEP

6144:Yu1O8/R/35k0UmtbxeAe26fNPNxAow/CzfB7+ZnAdjAAQnZF3Uvu:Yu13/R/3OWt36fNNqf+QZAdjAfZxUvu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2564	2792	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2792	2196	rundll32.exe	28
PID 2196 wrote to memory of 2792	2196	rundll32.exe	28
PID 2196 wrote to memory of 2792	2196	rundll32.exe	28
PID 2196 wrote to memory of 2792	2196	rundll32.exe	28
PID 2196 wrote to memory of 2792	2196	rundll32.exe	28
PID 2196 wrote to memory of 2792	2196	rundll32.exe	28
PID 2196 wrote to memory of 2792	2196	rundll32.exe	28
PID 2792 wrote to memory of 2564	2792	rundll32.exe	29
PID 2792 wrote to memory of 2564	2792	rundll32.exe	29
PID 2792 wrote to memory of 2564	2792	rundll32.exe	29
PID 2792 wrote to memory of 2564	2792	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6d32ae916a2cfd4220c5613f3a8210cfe3c8b1ed3b66a38588891a1d1bf7aab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6d32ae916a2cfd4220c5613f3a8210cfe3c8b1ed3b66a38588891a1d1bf7aab.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2792 -s 192
    3⤵
    - Program crash
    PID:2564