ad4093217d4b838217ccf0021c450a55b2be6ce8bfdafad645fec53cbade0abf

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 01:18

Target

2c7bdfde028ae9822d205bd361fa82cd97fdb89fb6fe528af3ed725f31c52ffd.dll
Size

248KB
MD5

178e90e3fc42c575e6cb505f1a40575c
SHA1

8d54af5e9c603fee94db315d198ef38f529b144c
SHA256

2c7bdfde028ae9822d205bd361fa82cd97fdb89fb6fe528af3ed725f31c52ffd
SHA512

f89deca1a2d77c4e9864c8e56ec02152fa079d17c4d9c29a1a37aa184c479283c33d5a3799fadda0fa2b857710f0a0ada18a6c8dc9f365e5de47b3754e75b45d
SSDEEP

3072:cnT2RRXuwcN3OQXB8CITr9VV2ILe126JyTu+djdUC5UEj:cwXupN1x8CgBbRLDTuOj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2328	2676	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2676	1984	rundll32.exe	30
PID 1984 wrote to memory of 2676	1984	rundll32.exe	30
PID 1984 wrote to memory of 2676	1984	rundll32.exe	30
PID 1984 wrote to memory of 2676	1984	rundll32.exe	30
PID 1984 wrote to memory of 2676	1984	rundll32.exe	30
PID 1984 wrote to memory of 2676	1984	rundll32.exe	30
PID 1984 wrote to memory of 2676	1984	rundll32.exe	30
PID 2676 wrote to memory of 2328	2676	rundll32.exe	31
PID 2676 wrote to memory of 2328	2676	rundll32.exe	31
PID 2676 wrote to memory of 2328	2676	rundll32.exe	31
PID 2676 wrote to memory of 2328	2676	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c7bdfde028ae9822d205bd361fa82cd97fdb89fb6fe528af3ed725f31c52ffd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c7bdfde028ae9822d205bd361fa82cd97fdb89fb6fe528af3ed725f31c52ffd.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 256
    3⤵
    - Program crash
    PID:2328