ed2a5bdf1a40aa83b5c918cfa5bd8bc5b8cf1216ffc3cc1a88de011e696c774c

Analysis

max time kernel
15s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 05:04

Target

57090bcbff67d9b878d2633c788e3b50N.dll
Size

37KB
MD5

57090bcbff67d9b878d2633c788e3b50
SHA1

e8d338dd20761aa4a7c263884a82765065b96dbc
SHA256

ed2a5bdf1a40aa83b5c918cfa5bd8bc5b8cf1216ffc3cc1a88de011e696c774c
SHA512

fd9fa45b96920cf3e85fb355bff9a757c0b4ae90750f6f4907f435536cf467dc22f0baecd78fd08ca96706d60837027e0afbbdd0fab7206998684a0a83e2eb23
SSDEEP

768:KKWeQCCnORymIEVIqhb+f3KH0EDVnuBpyLFN:jWeQCCORsWb71DLFN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2440	2068	WerFault.exe	31

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 2068	1648	rundll32.exe	31
PID 1648 wrote to memory of 2068	1648	rundll32.exe	31
PID 1648 wrote to memory of 2068	1648	rundll32.exe	31
PID 1648 wrote to memory of 2068	1648	rundll32.exe	31
PID 1648 wrote to memory of 2068	1648	rundll32.exe	31
PID 1648 wrote to memory of 2068	1648	rundll32.exe	31
PID 1648 wrote to memory of 2068	1648	rundll32.exe	31
PID 2068 wrote to memory of 2440	2068	rundll32.exe	32
PID 2068 wrote to memory of 2440	2068	rundll32.exe	32
PID 2068 wrote to memory of 2440	2068	rundll32.exe	32
PID 2068 wrote to memory of 2440	2068	rundll32.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\57090bcbff67d9b878d2633c788e3b50N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\57090bcbff67d9b878d2633c788e3b50N.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 220
    3⤵
    - Program crash
    PID:2440