08b3baa037ff1ef979544f921e7e4f023bb649c04e7aa929b2e4328cc5ac1138

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 03:32

Target

License Terms/SqlUserInstance.dll
Size

150KB
MD5

423671a408eedd5e51f4d4f6a3de4589
SHA1

7a96a2c6e2381e78bdd152e3caef75146460f488
SHA256

b62fab3be134e7765720c0eb579be5a65ae719771b1e39c14ac39958d554b90e
SHA512

4e9aa8c9ff248d4ec86d79b8515dbe51fa30aa5b28124a2c1872270c30e7887c1d49c573116237f393c29ef431b97110212fdac9d3a27134b6effdc5d373c11c
SSDEEP

3072:bm07GntHw9i1pCiY/cYCuyaBeipTCl/0YgPjGWuwLWW1cQFaNWpVfxTdv7OH3UCb:k9Y/cpascTg/0YgPjGWuwSW1cQae5TdS

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2872 968 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2872	968	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2316 wrote to memory of 968	2316	rundll32.exe	rundll32.exe
PID 2316 wrote to memory of 968	2316	rundll32.exe	rundll32.exe
PID 2316 wrote to memory of 968	2316	rundll32.exe	rundll32.exe
PID 2316 wrote to memory of 968	2316	rundll32.exe	rundll32.exe
PID 2316 wrote to memory of 968	2316	rundll32.exe	rundll32.exe
PID 2316 wrote to memory of 968	2316	rundll32.exe	rundll32.exe
PID 2316 wrote to memory of 968	2316	rundll32.exe	rundll32.exe
PID 968 wrote to memory of 2872	968	rundll32.exe	WerFault.exe
PID 968 wrote to memory of 2872	968	rundll32.exe	WerFault.exe
PID 968 wrote to memory of 2872	968	rundll32.exe	WerFault.exe
PID 968 wrote to memory of 2872	968	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\License Terms\SqlUserInstance.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2316

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\License Terms\SqlUserInstance.dll",#1
2⤵
- Suspicious use of WriteProcessMemory
PID:968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 968 -s 260
3⤵
- Program crash
PID:2872