8be410717226b5e873c61a30d92a767c6c6492ce6358cd79b2a41cb23dba05cd

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 09:31

Target

PersonMgrV108A/GetIDESN.dll
Size

24KB
MD5

12d1d37c9f8f178b4fb0e93896343449
SHA1

9e086495bf2fa61440c97e2ba6bf69d4c93e0aab
SHA256

0e1cd361eec1462681da97a14a23bdc9280092d4fa4ad3cf42593c23c21c5e65
SHA512

fe2fe83c39c30c58302cc75a22912db04384bb2723cb135e5cb64ff18539270ca9e90f42cd42dea8c3cfa70a96cc2c71d61ce8a5bbfdd864515a2d0dc0c4f914
SSDEEP

96:2az0v0ZFVfNeEEEuTtlyUKiIBBJB2DIBBJBfOTFQu5bxnbYRJgi:7Q0ZFVFeEEEuBlUJBxJBfORQMxb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2080	2688	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 2688	1600	rundll32.exe	30
PID 1600 wrote to memory of 2688	1600	rundll32.exe	30
PID 1600 wrote to memory of 2688	1600	rundll32.exe	30
PID 1600 wrote to memory of 2688	1600	rundll32.exe	30
PID 1600 wrote to memory of 2688	1600	rundll32.exe	30
PID 1600 wrote to memory of 2688	1600	rundll32.exe	30
PID 1600 wrote to memory of 2688	1600	rundll32.exe	30
PID 2688 wrote to memory of 2080	2688	rundll32.exe	31
PID 2688 wrote to memory of 2080	2688	rundll32.exe	31
PID 2688 wrote to memory of 2080	2688	rundll32.exe	31
PID 2688 wrote to memory of 2080	2688	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PersonMgrV108A\GetIDESN.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\PersonMgrV108A\GetIDESN.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 236
    3⤵
    - Program crash
    PID:2080