77d6610a1b6d2691f92140b83dcd56286ec2a303e11dc65bcd8f805990a69f02

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 17:22

Target

77d6610a1b6d2691f92140b83dcd56286ec2a303e11dc65bcd8f805990a69f02.dll
Size

242KB
MD5

277728db726a4b2f2c1a24d0a9845ae8
SHA1

4675a34e7e1a7d75d9f44588bb036816025cfc22
SHA256

77d6610a1b6d2691f92140b83dcd56286ec2a303e11dc65bcd8f805990a69f02
SHA512

ac1efa1342f1d130b39067110224c3d4534cf7be574c4f2df5bd4a466aeb6ba2d09f1072bf0d51fc306646052424f313afc4c9233f16c84703fd2c0ed95c12a9
SSDEEP

3072:1mkH4V2aLdAJJ5WcZW4TH25KXs8o66yWpQJU6fUzpqtcWGQT0Jkegj9UVY5494b/:Ykvae5Wck4CAal6U6MzJk7jg6

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1252 1520 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1252	1520	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2036 wrote to memory of 1520	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 1520	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 1520	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 1520	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 1520	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 1520	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 1520	2036	rundll32.exe	rundll32.exe
PID 1520 wrote to memory of 1252	1520	rundll32.exe	WerFault.exe
PID 1520 wrote to memory of 1252	1520	rundll32.exe	WerFault.exe
PID 1520 wrote to memory of 1252	1520	rundll32.exe	WerFault.exe
PID 1520 wrote to memory of 1252	1520	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\77d6610a1b6d2691f92140b83dcd56286ec2a303e11dc65bcd8f805990a69f02.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\77d6610a1b6d2691f92140b83dcd56286ec2a303e11dc65bcd8f805990a69f02.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 228
3⤵
- Program crash
PID:1252