9e6eef5154de943331f0f6ad4acff7036e574ef2c4994b967949c3215abf579f

Analysis

max time kernel
56s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 23:46

Target

9e6eef5154de943331f0f6ad4acff7036e574ef2c4994b967949c3215abf579f.dll
Size

120KB
MD5

6f0f9156a0bc0db4e36ed71de2f99460
SHA1

0ca090c4e2697560950e332b13560ec2df90d178
SHA256

9e6eef5154de943331f0f6ad4acff7036e574ef2c4994b967949c3215abf579f
SHA512

aecddc19235aab9cf457a1cf5c60b3e9edb6c96244af31b7b737fa74031e4ab725a43383cae1e9197b5143df4bb1568e28f0941b045f578539ef3a79a6b6a562
SSDEEP

3072:A8bwVuPTwfXPWttQIQ+kJYVISDLgv+q+67CU+v+dESyW:ByuKXPWttQIQ+kYPgmZwdh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1696	1612	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1612	2044	rundll32.exe	28
PID 2044 wrote to memory of 1612	2044	rundll32.exe	28
PID 2044 wrote to memory of 1612	2044	rundll32.exe	28
PID 2044 wrote to memory of 1612	2044	rundll32.exe	28
PID 2044 wrote to memory of 1612	2044	rundll32.exe	28
PID 2044 wrote to memory of 1612	2044	rundll32.exe	28
PID 2044 wrote to memory of 1612	2044	rundll32.exe	28
PID 1612 wrote to memory of 1696	1612	rundll32.exe	29
PID 1612 wrote to memory of 1696	1612	rundll32.exe	29
PID 1612 wrote to memory of 1696	1612	rundll32.exe	29
PID 1612 wrote to memory of 1696	1612	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9e6eef5154de943331f0f6ad4acff7036e574ef2c4994b967949c3215abf579f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9e6eef5154de943331f0f6ad4acff7036e574ef2c4994b967949c3215abf579f.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1612
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 196
    3⤵
    - Program crash
    PID:1696

memory/1612-55-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download
memory/1612-57-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download