6ee952d4f398c9a117360758af1881ecda3112b8856a3d008c9a7dea95d9cd8f

Analysis

max time kernel
23s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 01:20

Target

35fc70744357931db72943392db836b0N.dll
Size

164KB
MD5

35fc70744357931db72943392db836b0
SHA1

107e544df67e0ca720c3bcac0755ffc124355ea3
SHA256

6ee952d4f398c9a117360758af1881ecda3112b8856a3d008c9a7dea95d9cd8f
SHA512

1bb0a00bd1b5a6cb47058f7b9868682baee443c84c7af813f8874453a997e468e1408d358bcb121bab71c83b672450f2653933ffdd8d98a0551e21a121fbeeb2
SSDEEP

3072:QUOJxlLmRbSM5Lp3Q0YCmoUsihpKLszIzXBJCUcgoB:QUQUTAGihpKgACPB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2692	2076	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2076	2000	rundll32.exe	30
PID 2000 wrote to memory of 2076	2000	rundll32.exe	30
PID 2000 wrote to memory of 2076	2000	rundll32.exe	30
PID 2000 wrote to memory of 2076	2000	rundll32.exe	30
PID 2000 wrote to memory of 2076	2000	rundll32.exe	30
PID 2000 wrote to memory of 2076	2000	rundll32.exe	30
PID 2000 wrote to memory of 2076	2000	rundll32.exe	30
PID 2076 wrote to memory of 2692	2076	rundll32.exe	31
PID 2076 wrote to memory of 2692	2076	rundll32.exe	31
PID 2076 wrote to memory of 2692	2076	rundll32.exe	31
PID 2076 wrote to memory of 2692	2076	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\35fc70744357931db72943392db836b0N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\35fc70744357931db72943392db836b0N.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 228
    3⤵
    - Program crash
    PID:2692

memory/2076-0-0x00000000745A9000-0x00000000745CB000-memory.dmp

Filesize
136KB

Download
memory/2076-1-0x00000000745A9000-0x00000000745CB000-memory.dmp

Filesize
136KB

Download