c0a5ac074dc0c1669ba247e43789ee3bfddb2d583e9e342ac4fdd6ff3a93562f

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 02:19

Target

c0a5ac074dc0c1669ba247e43789ee3bfddb2d583e9e342ac4fdd6ff3a93562f.dll
Size

266KB
MD5

a3a1f9b32ef7aae19ac1419d1f4d6107
SHA1

a5a296672f8608d26fc03d37a94a315eae4f817a
SHA256

c0a5ac074dc0c1669ba247e43789ee3bfddb2d583e9e342ac4fdd6ff3a93562f
SHA512

bb96c6507dd374fc181a2c5ee8304904dd4c7289d3eecc4884019d764ef22cc3e74cbdd90ae3cb57a27788744518e1ba1d3d5f874f313c818f11220a439123d0
SSDEEP

6144:g/pb95LIbfMWZskFONizSLLsCn3cEFMWiFtNF7R5Lgr1A09:gBHEML25BkA09

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2152	2016	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 2016	1912	rundll32.exe	28
PID 1912 wrote to memory of 2016	1912	rundll32.exe	28
PID 1912 wrote to memory of 2016	1912	rundll32.exe	28
PID 1912 wrote to memory of 2016	1912	rundll32.exe	28
PID 1912 wrote to memory of 2016	1912	rundll32.exe	28
PID 1912 wrote to memory of 2016	1912	rundll32.exe	28
PID 1912 wrote to memory of 2016	1912	rundll32.exe	28
PID 2016 wrote to memory of 2152	2016	rundll32.exe	29
PID 2016 wrote to memory of 2152	2016	rundll32.exe	29
PID 2016 wrote to memory of 2152	2016	rundll32.exe	29
PID 2016 wrote to memory of 2152	2016	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0a5ac074dc0c1669ba247e43789ee3bfddb2d583e9e342ac4fdd6ff3a93562f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0a5ac074dc0c1669ba247e43789ee3bfddb2d583e9e342ac4fdd6ff3a93562f.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 224
    3⤵
    - Program crash
    PID:2152

memory/2016-1-0x0000000062000000-0x0000000062047000-memory.dmp

Filesize
284KB

Download
memory/2016-0-0x0000000062000000-0x0000000062047000-memory.dmp

Filesize
284KB

Download