ff3afd8eb7622bca8ea7fe7eb01daa3d0c93150d2ef0780a3d97ba674390ee97

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16-06-2024 10:53

Target

luyou/dbManage.dll
Size

649KB
MD5

b980618885823447a50110738cd75081
SHA1

0ea5773c46897a50e7d722a519b0c1a33727237c
SHA256

d913d6aac862119f7d38882f9a15a0bed1a0e99eeac5f2a18d696f429ea6e246
SHA512

4bfb5314df1f83a2995ab1e7e57fe24cc3ca56fea1d3c71dd72fedebec514e6709126e6e633b7096d3177f31213bdf6ee9beb76754a324ca1902904344665e07
SSDEEP

12288:Uz4fOGQZ7ONEaC95bcr3YSHxTNdms+VyTQrQewfmCB+R6jX44cLExT/dwYIqnui5:UmO7AEas5bcT1HxLWEPf/+8jItExTq+l

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1912	1604	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 1604	2180	rundll32.exe	28
PID 2180 wrote to memory of 1604	2180	rundll32.exe	28
PID 2180 wrote to memory of 1604	2180	rundll32.exe	28
PID 2180 wrote to memory of 1604	2180	rundll32.exe	28
PID 2180 wrote to memory of 1604	2180	rundll32.exe	28
PID 2180 wrote to memory of 1604	2180	rundll32.exe	28
PID 2180 wrote to memory of 1604	2180	rundll32.exe	28
PID 1604 wrote to memory of 1912	1604	rundll32.exe	29
PID 1604 wrote to memory of 1912	1604	rundll32.exe	29
PID 1604 wrote to memory of 1912	1604	rundll32.exe	29
PID 1604 wrote to memory of 1912	1604	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\luyou\dbManage.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\luyou\dbManage.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1604
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 220
    3⤵
    - Program crash
    PID:1912