1d59e045d47521bb4b3efbf731636611774b5de594b3094fc579d172000591f9

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 07:49

Target

1d59e045d47521bb4b3efbf731636611774b5de594b3094fc579d172000591f9.dll
Size

2.0MB
MD5

b42b3c1bd526e9a34f45828491cfe4b6
SHA1

f48860ba2ee5c2743c3e2f5a04220d826706d388
SHA256

1d59e045d47521bb4b3efbf731636611774b5de594b3094fc579d172000591f9
SHA512

6dc20bafda1da246cae3393a2de7979f9389fa4ad1705d6f7b0a9f4994df7160b49b3c5dbf65d1b387b629b6954d65936f5bd15053bc9fe16a74efb04b13881b
SSDEEP

49152:SpW2WCN9mIFOKjQ5TwaonUr1q7NWcPjHPhVbC5GMhE:SpW2WCDmIFOh5Tw4q7NWsvh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2812	2036	WerFault.exe	31

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 2036	1876	rundll32.exe	31
PID 1876 wrote to memory of 2036	1876	rundll32.exe	31
PID 1876 wrote to memory of 2036	1876	rundll32.exe	31
PID 1876 wrote to memory of 2036	1876	rundll32.exe	31
PID 1876 wrote to memory of 2036	1876	rundll32.exe	31
PID 1876 wrote to memory of 2036	1876	rundll32.exe	31
PID 1876 wrote to memory of 2036	1876	rundll32.exe	31
PID 2036 wrote to memory of 2812	2036	rundll32.exe	32
PID 2036 wrote to memory of 2812	2036	rundll32.exe	32
PID 2036 wrote to memory of 2812	2036	rundll32.exe	32
PID 2036 wrote to memory of 2812	2036	rundll32.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d59e045d47521bb4b3efbf731636611774b5de594b3094fc579d172000591f9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d59e045d47521bb4b3efbf731636611774b5de594b3094fc579d172000591f9.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 268
    3⤵
    - Program crash
    PID:2812