efe07669d0295342c38cbf96ac5e461b45dc02ad528b2560b2453947d497d691

Analysis

max time kernel
143s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 21:46

Target

efe07669d0295342c38cbf96ac5e461b45dc02ad528b2560b2453947d497d691.dll
Size

58KB
MD5

170060e139ebf48ad98b82bb3edcd329
SHA1

055114c178af24e82301c17e6849a0ff58ef7401
SHA256

efe07669d0295342c38cbf96ac5e461b45dc02ad528b2560b2453947d497d691
SHA512

e8aa1dc4fedfb5e3354ecc0cb64ab6f35c58c70b97c7db1b611f11681e69fd46b309fad070176a8c4101cf799b46bb9a553732c10c901618b4753187f951e432
SSDEEP

768:yZUFSCzpi68E4T2QKblGboVhDMxon3aXCBw0zDVnnL9LFvJw6B8VrRd4re6RxXYy:yeFSCY6m2I0o6n3ZBw0tnL97QFGBN

Score

8^/10

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1272	1308	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1308	2016	rundll32.exe	27
PID 2016 wrote to memory of 1308	2016	rundll32.exe	27
PID 2016 wrote to memory of 1308	2016	rundll32.exe	27
PID 2016 wrote to memory of 1308	2016	rundll32.exe	27
PID 2016 wrote to memory of 1308	2016	rundll32.exe	27
PID 2016 wrote to memory of 1308	2016	rundll32.exe	27
PID 2016 wrote to memory of 1308	2016	rundll32.exe	27
PID 1308 wrote to memory of 1272	1308	rundll32.exe	28
PID 1308 wrote to memory of 1272	1308	rundll32.exe	28
PID 1308 wrote to memory of 1272	1308	rundll32.exe	28
PID 1308 wrote to memory of 1272	1308	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\efe07669d0295342c38cbf96ac5e461b45dc02ad528b2560b2453947d497d691.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\efe07669d0295342c38cbf96ac5e461b45dc02ad528b2560b2453947d497d691.dll,#1
  2⤵
  - Drops file in Drivers directory
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 212
    3⤵
    - Program crash
    PID:1272

memory/1308-55-0x0000000075661000-0x0000000075663000-memory.dmp

Filesize
8KB

Download
memory/1308-56-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/1308-58-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/1308-59-0x0000000000170000-0x0000000000182000-memory.dmp

Filesize
72KB

Download
memory/1308-60-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/1308-61-0x0000000000170000-0x0000000000182000-memory.dmp

Filesize
72KB

Download
memory/1308-62-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download