a00efafb9deb99a99bfdd34f55818983e9cc675d1cac6b71b9fec4b0bea1aa56

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 08:22

Target

CoralUpdate.dll
Size

352KB
MD5

7b1938124b07781bea91fae264e99f87
SHA1

39ff40d2b9d1e5f51a2d9817d801c4242d21763e
SHA256

281bd67d445ccc728f5a92fb8200e306cd8d4d311a6a9edcb8c9760cf9d1ea93
SHA512

6bee84c135c60496eb79b272afbb5881cc3c1ac82bcf370b40209b5532d3922fec7be4b5af05044ef644146cda7d0baa32f344b86a40f1c27d416bb758c743bd
SSDEEP

6144:NiQRHSkgCAoHD/LDtwd3Zp5VsjInbJC65iRnGik0MPAcTHe1OjDxW6aOgoftcl:BZAoj/L2d31QoiRnGilcTHYOPJ0l

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2136	1696	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 1696	3020	rundll32.exe	28
PID 3020 wrote to memory of 1696	3020	rundll32.exe	28
PID 3020 wrote to memory of 1696	3020	rundll32.exe	28
PID 3020 wrote to memory of 1696	3020	rundll32.exe	28
PID 3020 wrote to memory of 1696	3020	rundll32.exe	28
PID 3020 wrote to memory of 1696	3020	rundll32.exe	28
PID 3020 wrote to memory of 1696	3020	rundll32.exe	28
PID 1696 wrote to memory of 2136	1696	rundll32.exe	29
PID 1696 wrote to memory of 2136	1696	rundll32.exe	29
PID 1696 wrote to memory of 2136	1696	rundll32.exe	29
PID 1696 wrote to memory of 2136	1696	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CoralUpdate.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\CoralUpdate.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 240
    3⤵
    - Program crash
    PID:2136