3ef56fb19994148a7a18c028e6f04685fcdaa8077755639b9c34edb4a548d8e6

Analysis

Target

3ef56fb19994148a7a18c028e6f04685fcdaa8077755639b9c34edb4a548d8e6.dll
Size

1.1MB
MD5

abb3a1591d419e3980c306b3603f768e
SHA1

bd8053fc82663c618b7f48ecb44aeda13b501438
SHA256

3ef56fb19994148a7a18c028e6f04685fcdaa8077755639b9c34edb4a548d8e6
SHA512

7a6f85fb350a6b62a296b5cbf405cbdc5a0fe3625d8fafc4f84eee1ba2d84827f63ca9bd65d1edffa7209e87f22468f028414dce2abcefc75ec37e1e983e126f

Score

8^/10

Blocklisted process makes network request 10 IoCs

Processes:

rundll32.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
3900	4372	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 1700 wrote to memory of 4372	1700	rundll32.exe	82
PID 1700 wrote to memory of 4372	1700	rundll32.exe	82
PID 1700 wrote to memory of 4372	1700	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ef56fb19994148a7a18c028e6f04685fcdaa8077755639b9c34edb4a548d8e6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ef56fb19994148a7a18c028e6f04685fcdaa8077755639b9c34edb4a548d8e6.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:4372
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 816
    3⤵
    - Program crash
    PID:3900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4372 -ip 4372
1⤵
PID:4936