efe07669d0295342c38cbf96ac5e461b45dc02ad528b2560b2453947d497d691

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 21:46

Target

efe07669d0295342c38cbf96ac5e461b45dc02ad528b2560b2453947d497d691.dll
Size

58KB
MD5

170060e139ebf48ad98b82bb3edcd329
SHA1

055114c178af24e82301c17e6849a0ff58ef7401
SHA256

efe07669d0295342c38cbf96ac5e461b45dc02ad528b2560b2453947d497d691
SHA512

e8aa1dc4fedfb5e3354ecc0cb64ab6f35c58c70b97c7db1b611f11681e69fd46b309fad070176a8c4101cf799b46bb9a553732c10c901618b4753187f951e432
SSDEEP

768:yZUFSCzpi68E4T2QKblGboVhDMxon3aXCBw0zDVnnL9LFvJw6B8VrRd4re6RxXYy:yeFSCY6m2I0o6n3ZBw0tnL97QFGBN

Score

8^/10

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5044	1964	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 1964	2564	rundll32.exe	79
PID 2564 wrote to memory of 1964	2564	rundll32.exe	79
PID 2564 wrote to memory of 1964	2564	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\efe07669d0295342c38cbf96ac5e461b45dc02ad528b2560b2453947d497d691.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\efe07669d0295342c38cbf96ac5e461b45dc02ad528b2560b2453947d497d691.dll,#1
  2⤵
  - Drops file in Drivers directory
  PID:1964
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 652
    3⤵
    - Program crash
    PID:5044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 1964 -ip 1964
1⤵
PID:1140

memory/1964-133-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/1964-134-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/1964-135-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/1964-136-0x0000000001010000-0x0000000001022000-memory.dmp

Filesize
72KB

Download