09e65a661e85c3a3ab0e848809e44f20332b9f46cf5da364c7c8d3992c957f85

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 21:01

Target

AutoUpdate/AutoUpdateUtil.dll
Size

198KB
MD5

1e751e9ac7a6905d2f1b2860cc7d37a7
SHA1

6e7171f68a1c432a512cae3901d35faad550ca0e
SHA256

9b95b90e36e4f7bf257e56fadf6f7630fa70696c072f7b8d6de05eab87e0674e
SHA512

f54af4149c1d24f05fdb3c1d8b48f31444763e7c4effdcd9013c8c90a8aa7fa4531b00d5ee1b3f08fcfbebcd06aaf8aa318c40943a59e611d5c24435a0562034
SSDEEP

3072:3Oq3B8kyfQQC2mC2gbvCsGowP96rH0Vu3b1vJ4gMdyJVj+G3O1fnAtZY:eq3BJ4vCCa9VgxR+GGvAK

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2200 1816 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2200	1816	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2580 wrote to memory of 1816	2580	rundll32.exe	rundll32.exe
PID 2580 wrote to memory of 1816	2580	rundll32.exe	rundll32.exe
PID 2580 wrote to memory of 1816	2580	rundll32.exe	rundll32.exe
PID 2580 wrote to memory of 1816	2580	rundll32.exe	rundll32.exe
PID 2580 wrote to memory of 1816	2580	rundll32.exe	rundll32.exe
PID 2580 wrote to memory of 1816	2580	rundll32.exe	rundll32.exe
PID 2580 wrote to memory of 1816	2580	rundll32.exe	rundll32.exe
PID 1816 wrote to memory of 2200	1816	rundll32.exe	WerFault.exe
PID 1816 wrote to memory of 2200	1816	rundll32.exe	WerFault.exe
PID 1816 wrote to memory of 2200	1816	rundll32.exe	WerFault.exe
PID 1816 wrote to memory of 2200	1816	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AutoUpdate\AutoUpdateUtil.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\AutoUpdate\AutoUpdateUtil.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 220
    3⤵
    - Program crash
    PID:2200