260bd64aff76afa4a037ea5b97499e8e5f7819ce34509360f0cbb78b42f5292e

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
21-06-2024 04:06

Target

http_dll.dll
Size

127KB
MD5

5c28d36c6cc39b20c882cfdc1235a684
SHA1

d4d829cdb28b081ed72547b8fc63bfc9aaf22f06
SHA256

260bd64aff76afa4a037ea5b97499e8e5f7819ce34509360f0cbb78b42f5292e
SHA512

1dfd293b47b46082890dfee015f3284f02032c942f1b51afcdd58031a7d2e80db87a7d13eda85c1ebc1acea5580b669c1d7d8b7b61c75778e663cb48b9671275
SSDEEP

1536:h+sRWd4nhueU5u2s1N/47TVWeBeu644kPOLD38lKHPEryZ21uZjYCBA3MpM7c8uB:5sURE3VW8POLwlKb21uRYCuLMF6eok

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2828	2496	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 2496	1640	rundll32.exe	28
PID 1640 wrote to memory of 2496	1640	rundll32.exe	28
PID 1640 wrote to memory of 2496	1640	rundll32.exe	28
PID 1640 wrote to memory of 2496	1640	rundll32.exe	28
PID 1640 wrote to memory of 2496	1640	rundll32.exe	28
PID 1640 wrote to memory of 2496	1640	rundll32.exe	28
PID 1640 wrote to memory of 2496	1640	rundll32.exe	28
PID 2496 wrote to memory of 2828	2496	rundll32.exe	29
PID 2496 wrote to memory of 2828	2496	rundll32.exe	29
PID 2496 wrote to memory of 2828	2496	rundll32.exe	29
PID 2496 wrote to memory of 2828	2496	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\http_dll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\http_dll.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2496
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 220
    3⤵
    - Program crash
    PID:2828