1f99c0bd574a4f03ff854f42c401ea5a5ca79a15a1e0cdee754f4826d1c4300e

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
19/06/2024, 19:29

Target

1f99c0bd574a4f03ff854f42c401ea5a5ca79a15a1e0cdee754f4826d1c4300e.dll
Size

113KB
MD5

c57132facae7af48d3d61c42c2a3d42a
SHA1

f0fd86dbde1fa807f040ee54eae7704ca69e8d7b
SHA256

1f99c0bd574a4f03ff854f42c401ea5a5ca79a15a1e0cdee754f4826d1c4300e
SHA512

61a05a468d4dcd937100b7f44b38db8a645563112df629ef128132058f8118e9e2b1b95815c1657fb97de18cfc55779908243ff8819286ffacf4c2e6245eaefd
SSDEEP

1536:YRA7XOXLXiywsc5KlymxgkVIgw9vW24eDkia2WdfsA8SWQUnQjtiBYBuq:nOX+swmzOlvyeq0A+S0YBuq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1056	1252	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 1252	1988	rundll32.exe	28
PID 1988 wrote to memory of 1252	1988	rundll32.exe	28
PID 1988 wrote to memory of 1252	1988	rundll32.exe	28
PID 1988 wrote to memory of 1252	1988	rundll32.exe	28
PID 1988 wrote to memory of 1252	1988	rundll32.exe	28
PID 1988 wrote to memory of 1252	1988	rundll32.exe	28
PID 1988 wrote to memory of 1252	1988	rundll32.exe	28
PID 1252 wrote to memory of 1056	1252	rundll32.exe	29
PID 1252 wrote to memory of 1056	1252	rundll32.exe	29
PID 1252 wrote to memory of 1056	1252	rundll32.exe	29
PID 1252 wrote to memory of 1056	1252	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1f99c0bd574a4f03ff854f42c401ea5a5ca79a15a1e0cdee754f4826d1c4300e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1f99c0bd574a4f03ff854f42c401ea5a5ca79a15a1e0cdee754f4826d1c4300e.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 224
    3⤵
    - Program crash
    PID:1056