d32594a40b9c4135753c2dd2705c956e1c4edb030346177286a93f9d61256ded

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 01:41

Target

Update.dll
Size

196KB
MD5

9c095f5ba49d93291c68f5ce23fc2e3e
SHA1

1cf9f8968547c6f4f526b1f66d6ddb6463294aee
SHA256

c27f678a5308b841f06e8f6679f311a6ff24ce73ba1d26249328e5c882235e04
SHA512

85c5ad8be5e8e16407c09d6413393e432b58b92d34e50868c2b94b2e5f924598f5b0f2e21533abba4189ee294dfd445fb56cda947ec894c0e8a5b85e79f7abcf
SSDEEP

6144:MzBDNhnJfgmJbeKby/z5wPuRFD5XlfRwT:yhJtJbeKOL5wGr5J8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2756	2940	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2940	2876	rundll32.exe	30
PID 2876 wrote to memory of 2940	2876	rundll32.exe	30
PID 2876 wrote to memory of 2940	2876	rundll32.exe	30
PID 2876 wrote to memory of 2940	2876	rundll32.exe	30
PID 2876 wrote to memory of 2940	2876	rundll32.exe	30
PID 2876 wrote to memory of 2940	2876	rundll32.exe	30
PID 2876 wrote to memory of 2940	2876	rundll32.exe	30
PID 2940 wrote to memory of 2756	2940	rundll32.exe	31
PID 2940 wrote to memory of 2756	2940	rundll32.exe	31
PID 2940 wrote to memory of 2756	2940	rundll32.exe	31
PID 2940 wrote to memory of 2756	2940	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Update.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Update.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 244
    3⤵
    - Program crash
    PID:2756

memory/2940-0-0x0000000000260000-0x000000000031E000-memory.dmp

Filesize
760KB

Download
memory/2940-1-0x0000000000260000-0x000000000031E000-memory.dmp

Filesize
760KB

Download
memory/2940-2-0x0000000000260000-0x000000000031E000-memory.dmp

Filesize
760KB

Download
memory/2940-3-0x0000000000260000-0x000000000031E000-memory.dmp

Filesize
760KB

Download
memory/2940-4-0x00000000002EC000-0x00000000002ED000-memory.dmp

Filesize
4KB

Download