07b64ee946cf08326b05a380fedeec94f6da8c2f557040447134b30b1dbcfff2

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 18:38

Target

07b64ee946cf08326b05a380fedeec94f6da8c2f557040447134b30b1dbcfff2.dll
Size

20KB
MD5

d1ce027186875abb6276c3c728ebc608
SHA1

a4ec7cf604b466079395c8a4b80bfcc7274f18a1
SHA256

07b64ee946cf08326b05a380fedeec94f6da8c2f557040447134b30b1dbcfff2
SHA512

418458c102cf3be56c0fb46c2899b52c60922974bccec8d22113ebde3b747ab143e20d4a9dc494184f623803009f7c6f14f7e1907fea14a0de65928d9796d9f5
SSDEEP

96:X908s82LTQTLnOU19Fi6kITearYEoosuvV/O:t08n2fQ/P1QIqajoosk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3032	2864	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2864	2336	rundll32.exe	30
PID 2336 wrote to memory of 2864	2336	rundll32.exe	30
PID 2336 wrote to memory of 2864	2336	rundll32.exe	30
PID 2336 wrote to memory of 2864	2336	rundll32.exe	30
PID 2336 wrote to memory of 2864	2336	rundll32.exe	30
PID 2336 wrote to memory of 2864	2336	rundll32.exe	30
PID 2336 wrote to memory of 2864	2336	rundll32.exe	30
PID 2864 wrote to memory of 3032	2864	rundll32.exe	31
PID 2864 wrote to memory of 3032	2864	rundll32.exe	31
PID 2864 wrote to memory of 3032	2864	rundll32.exe	31
PID 2864 wrote to memory of 3032	2864	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\07b64ee946cf08326b05a380fedeec94f6da8c2f557040447134b30b1dbcfff2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\07b64ee946cf08326b05a380fedeec94f6da8c2f557040447134b30b1dbcfff2.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2864 -s 228
    3⤵
    - Program crash
    PID:3032