266c03f3b522ed19de27183fdf1bd951a27c8a50c667005c3ac6da869965a86d

Analysis

Target

266c03f3b522ed19de27183fdf1bd951a27c8a50c667005c3ac6da869965a86d.dll
Size

487KB
MD5

2233ff739449364c83d9b678e9dcd051
SHA1

83debcd6fa9e07ce1c8bfdcaeb03e0eeb9018b08
SHA256

266c03f3b522ed19de27183fdf1bd951a27c8a50c667005c3ac6da869965a86d
SHA512

eb244bea7788e3a84a7cfd84406f456c8a2bcbebf58008b569ebc21aeec7f606110f46a12bd1a1b4a00ef4fb76c8c20655f0267587f10a4c7fe5fd8d84fe1b35

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1464	1668	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 1668	1452	rundll32.exe	28
PID 1452 wrote to memory of 1668	1452	rundll32.exe	28
PID 1452 wrote to memory of 1668	1452	rundll32.exe	28
PID 1452 wrote to memory of 1668	1452	rundll32.exe	28
PID 1452 wrote to memory of 1668	1452	rundll32.exe	28
PID 1452 wrote to memory of 1668	1452	rundll32.exe	28
PID 1452 wrote to memory of 1668	1452	rundll32.exe	28
PID 1668 wrote to memory of 1464	1668	rundll32.exe	29
PID 1668 wrote to memory of 1464	1668	rundll32.exe	29
PID 1668 wrote to memory of 1464	1668	rundll32.exe	29
PID 1668 wrote to memory of 1464	1668	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\266c03f3b522ed19de27183fdf1bd951a27c8a50c667005c3ac6da869965a86d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\266c03f3b522ed19de27183fdf1bd951a27c8a50c667005c3ac6da869965a86d.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 272
    3⤵
    - Program crash
    PID:1464

memory/1668-55-0x0000000075EF1000-0x0000000075EF3000-memory.dmp

Filesize
8KB

Download