266c03f3b522ed19de27183fdf1bd951a27c8a50c667005c3ac6da869965a86d

Analysis

Target
266c03f3b522ed19de27183fdf1bd951a27c8a50c667005c3ac6da869965a86d.dll
Size 487KB
Sample220629-t4elmsbbbm
SHA256 266c03f3b522ed19de27183fdf1bd951a27c8a50c667005c3ac6da869965a86d
MD5 2233ff739449364c83d9b678e9dcd051
SHA1 83debcd6fa9e07ce1c8bfdcaeb03e0eeb9018b08
SHA512 eb244bea7788e3a84a7cfd84406f456c8a2bcbebf58008b569ebc21aeec7f606110f46a12bd1a1b4a00ef4fb76c8c20655f0267587f10a4c7fe5fd8d84fe1b35
MD5 SHA1 SHA512

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1580	3632	WerFault.exe	80
3680	3632	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 3632	1904	rundll32.exe	80
PID 1904 wrote to memory of 3632	1904	rundll32.exe	80
PID 1904 wrote to memory of 3632	1904	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\266c03f3b522ed19de27183fdf1bd951a27c8a50c667005c3ac6da869965a86d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\266c03f3b522ed19de27183fdf1bd951a27c8a50c667005c3ac6da869965a86d.dll,#1
  2⤵
  PID:3632
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 544
    3⤵
    - Program crash
    PID:1580
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 820
    3⤵
    - Program crash
    PID:3680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3632 -ip 3632
1⤵
PID:1052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3632 -ip 3632
1⤵
PID:3296