5791d47b59c01cc5a9200cbaf2944b1f49401967862e3f57c50522e3e8e01c01

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 00:22

Target

5791d47b59c01cc5a9200cbaf2944b1f49401967862e3f57c50522e3e8e01c01.dll
Size

205KB
MD5

4995bc5dc16a41f4116ae8087a76f8ee
SHA1

e01dde1d19328909ce6d3aca4372697f6eca59ec
SHA256

5791d47b59c01cc5a9200cbaf2944b1f49401967862e3f57c50522e3e8e01c01
SHA512

51fca1a612585581720cc01a8d7d64ec4e095759b75a01c3c098716da2396eaadc3f7f0922b148c9bc457afd47ae5021eb380589468e559a9b8ea6c749df1d08
SSDEEP

3072:0/QPFX1eqEfuBNSYuiM8CNj8hFsoMX0ghsJRgCD3iFw9jdUi5Qp:0/MEfuN0t8C5oFsoeRM3o0j0

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1728 1272 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1728	1272	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2444 wrote to memory of 1272	2444	rundll32.exe	rundll32.exe
PID 2444 wrote to memory of 1272	2444	rundll32.exe	rundll32.exe
PID 2444 wrote to memory of 1272	2444	rundll32.exe	rundll32.exe
PID 2444 wrote to memory of 1272	2444	rundll32.exe	rundll32.exe
PID 2444 wrote to memory of 1272	2444	rundll32.exe	rundll32.exe
PID 2444 wrote to memory of 1272	2444	rundll32.exe	rundll32.exe
PID 2444 wrote to memory of 1272	2444	rundll32.exe	rundll32.exe
PID 1272 wrote to memory of 1728	1272	rundll32.exe	WerFault.exe
PID 1272 wrote to memory of 1728	1272	rundll32.exe	WerFault.exe
PID 1272 wrote to memory of 1728	1272	rundll32.exe	WerFault.exe
PID 1272 wrote to memory of 1728	1272	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5791d47b59c01cc5a9200cbaf2944b1f49401967862e3f57c50522e3e8e01c01.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2444

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5791d47b59c01cc5a9200cbaf2944b1f49401967862e3f57c50522e3e8e01c01.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1272 -s 232
3⤵
- Program crash
PID:1728