2b6ba00a201f4595149d7215a3d5c8351c0348f87c7f3ece84a77439f5949859

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 22:49

Target

2b6ba00a201f4595149d7215a3d5c8351c0348f87c7f3ece84a77439f5949859.dll
Size

372KB
MD5

0f312946e3cb06ec7ecfabde5fd2698c
SHA1

64cdd48f3e134a07cbf193cf2e46a57d71cf0368
SHA256

2b6ba00a201f4595149d7215a3d5c8351c0348f87c7f3ece84a77439f5949859
SHA512

3102d5a8d53a0c5cab2558d834c25946f22cff532ef9575d92db664a4afd2c5085f4f24084bd53d061e1a2eb366f477e8c8ec0cb3d219013e8558685a8008d52
SSDEEP

6144:Z1raY9m9wm+wzcxcp2hBmqvGILf8hQP+n+HH9g7nj:Z1h9mwdvxcp2GqeILfqn+n6j

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2784	2780	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 2780	2720	rundll32.exe	30
PID 2720 wrote to memory of 2780	2720	rundll32.exe	30
PID 2720 wrote to memory of 2780	2720	rundll32.exe	30
PID 2720 wrote to memory of 2780	2720	rundll32.exe	30
PID 2720 wrote to memory of 2780	2720	rundll32.exe	30
PID 2720 wrote to memory of 2780	2720	rundll32.exe	30
PID 2720 wrote to memory of 2780	2720	rundll32.exe	30
PID 2780 wrote to memory of 2784	2780	rundll32.exe	31
PID 2780 wrote to memory of 2784	2780	rundll32.exe	31
PID 2780 wrote to memory of 2784	2780	rundll32.exe	31
PID 2780 wrote to memory of 2784	2780	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6ba00a201f4595149d7215a3d5c8351c0348f87c7f3ece84a77439f5949859.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6ba00a201f4595149d7215a3d5c8351c0348f87c7f3ece84a77439f5949859.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 220
    3⤵
    - Program crash
    PID:2784