a488eae2884937cf51ac2e483d55977eab3f3a3bdbe2fbf892d39b4168569a68

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 01:26

Target

a488eae2884937cf51ac2e483d55977eab3f3a3bdbe2fbf892d39b4168569a68.dll
Size

80KB
MD5

22a69c4b7f24d66a5cb9508a671237a7
SHA1

22a9820f8e95bba92d50738bbef69a089708b261
SHA256

a488eae2884937cf51ac2e483d55977eab3f3a3bdbe2fbf892d39b4168569a68
SHA512

a04138666a3ef431e9bc9a60e29716b1e308727d94ef6501896f2cccc25b580890674d721b6bc46589515e0d4eb8d2c67fbad9ca1b3c2c916d267713b7242da1
SSDEEP

768:CmRYp1o49NLh08wd3SIQCjGwHqHZKimfDNexCR2TF7RuIT0DIOlIOCnToIf1PKey:k170awKu5epADIOlIOCnToIfny

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2600	1908	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1908	1992	rundll32.exe	28
PID 1992 wrote to memory of 1908	1992	rundll32.exe	28
PID 1992 wrote to memory of 1908	1992	rundll32.exe	28
PID 1992 wrote to memory of 1908	1992	rundll32.exe	28
PID 1992 wrote to memory of 1908	1992	rundll32.exe	28
PID 1992 wrote to memory of 1908	1992	rundll32.exe	28
PID 1992 wrote to memory of 1908	1992	rundll32.exe	28
PID 1908 wrote to memory of 2600	1908	rundll32.exe	29
PID 1908 wrote to memory of 2600	1908	rundll32.exe	29
PID 1908 wrote to memory of 2600	1908	rundll32.exe	29
PID 1908 wrote to memory of 2600	1908	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a488eae2884937cf51ac2e483d55977eab3f3a3bdbe2fbf892d39b4168569a68.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a488eae2884937cf51ac2e483d55977eab3f3a3bdbe2fbf892d39b4168569a68.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1908
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 224
    3⤵
    - Program crash
    PID:2600