72c018224ed1dfabeb9648b75aa38e1d539af0a578258943f75baea71deb45e4

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 02:22

Target

72c018224ed1dfabeb9648b75aa38e1d539af0a578258943f75baea71deb45e4.dll
Size

208KB
MD5

34694bac391a72ad99777a96da2ab884
SHA1

ffdf6a7d932527fa1885148ed8e40831f4ffc207
SHA256

72c018224ed1dfabeb9648b75aa38e1d539af0a578258943f75baea71deb45e4
SHA512

bca6ff1b89ffe004d0d3d7488f5a3ede47acacf446527b06d4a449388b29e110363685d0489a8bd8092a41bd7764c1483371adac1be786c8f816fe8db743d5e9
SSDEEP

3072:cI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdUJKY5H:cIDff9D8C6XYRw6MT2DEjK

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2336 3024 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2336	3024	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2432 wrote to memory of 3024	2432	rundll32.exe	rundll32.exe
PID 2432 wrote to memory of 3024	2432	rundll32.exe	rundll32.exe
PID 2432 wrote to memory of 3024	2432	rundll32.exe	rundll32.exe
PID 2432 wrote to memory of 3024	2432	rundll32.exe	rundll32.exe
PID 2432 wrote to memory of 3024	2432	rundll32.exe	rundll32.exe
PID 2432 wrote to memory of 3024	2432	rundll32.exe	rundll32.exe
PID 2432 wrote to memory of 3024	2432	rundll32.exe	rundll32.exe
PID 3024 wrote to memory of 2336	3024	rundll32.exe	WerFault.exe
PID 3024 wrote to memory of 2336	3024	rundll32.exe	WerFault.exe
PID 3024 wrote to memory of 2336	3024	rundll32.exe	WerFault.exe
PID 3024 wrote to memory of 2336	3024	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\72c018224ed1dfabeb9648b75aa38e1d539af0a578258943f75baea71deb45e4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2432

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\72c018224ed1dfabeb9648b75aa38e1d539af0a578258943f75baea71deb45e4.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:3024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 232
3⤵
- Program crash
PID:2336