5dde351516155c3ec5f77c4b93018609d6beeb642a03f12d5da30f0e1ca9d410

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
16-07-2024 06:46

Target

HandleUpdate.dll
Size

1.5MB
MD5

4c10f80fc0e6bf4561dc4c2f9dc15e4c
SHA1

2cea6e0e220469173928510296a1b6a1b65f8c25
SHA256

bf29393c138a865535682c99cca2920e00f15a17bba14ae6ffb915de55535dd6
SHA512

07a18da0f91321232ad434d11382387a7e1381e9e55f37a53031f701aafdc3541b1b7465e0c2d3a53cfef022c526596ab0894e28b4c1c3b1fbb537b8ea65a6a7
SSDEEP

49152:zcqgaNMrg1bqbgPF7G6yFi9wdHqqz+z+NTwq2OYZJtkaPfMD/mxn:z2a31+bgPF7G6yFi9w1qS+z+NkOYZzkY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2500	1540	WerFault.exe	29

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 1540	2320	rundll32.exe	29
PID 2320 wrote to memory of 1540	2320	rundll32.exe	29
PID 2320 wrote to memory of 1540	2320	rundll32.exe	29
PID 2320 wrote to memory of 1540	2320	rundll32.exe	29
PID 2320 wrote to memory of 1540	2320	rundll32.exe	29
PID 2320 wrote to memory of 1540	2320	rundll32.exe	29
PID 2320 wrote to memory of 1540	2320	rundll32.exe	29
PID 1540 wrote to memory of 2500	1540	rundll32.exe	30
PID 1540 wrote to memory of 2500	1540	rundll32.exe	30
PID 1540 wrote to memory of 2500	1540	rundll32.exe	30
PID 1540 wrote to memory of 2500	1540	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HandleUpdate.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\HandleUpdate.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1540
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 252
    3⤵
    - Program crash
    PID:2500