ed63f671609081aa0cff5e5625cbf7b42132ec6db393055bd1fbbfdee289b752

Analysis

max time kernel
37s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 04:44

Target

ed63f671609081aa0cff5e5625cbf7b42132ec6db393055bd1fbbfdee289b752.dll
Size

114KB
MD5

5628c3d38b6c383283a6c45d3257d37f
SHA1

d9e10737f3152f27a5c9071702d2ee1eeb5389a7
SHA256

ed63f671609081aa0cff5e5625cbf7b42132ec6db393055bd1fbbfdee289b752
SHA512

7bd9dc4960e7f9e8f07299104c7183a255ca972cf2a8a0b961051662c0feda039b50470bc91d4ee5a9218476353f962dc38a6f1e035f744ac356716d0a4d53ac
SSDEEP

3072:v8pINCf/qPkhR8GNR/iKEbY9v46VtVpW:vxwfCPw8GL/iO9v7Xp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1780	912	WerFault.exe	14

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 912	1832	rundll32.exe	14
PID 1832 wrote to memory of 912	1832	rundll32.exe	14
PID 1832 wrote to memory of 912	1832	rundll32.exe	14
PID 1832 wrote to memory of 912	1832	rundll32.exe	14
PID 1832 wrote to memory of 912	1832	rundll32.exe	14
PID 1832 wrote to memory of 912	1832	rundll32.exe	14
PID 1832 wrote to memory of 912	1832	rundll32.exe	14
PID 912 wrote to memory of 1780	912	rundll32.exe	15
PID 912 wrote to memory of 1780	912	rundll32.exe	15
PID 912 wrote to memory of 1780	912	rundll32.exe	15
PID 912 wrote to memory of 1780	912	rundll32.exe	15

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ed63f671609081aa0cff5e5625cbf7b42132ec6db393055bd1fbbfdee289b752.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ed63f671609081aa0cff5e5625cbf7b42132ec6db393055bd1fbbfdee289b752.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 912 -s 248
    3⤵
    - Program crash
    PID:1780

memory/912-55-0x00000000751A1000-0x00000000751A3000-memory.dmp

Filesize
8KB

Download
memory/912-57-0x00000000001D0000-0x00000000001F0000-memory.dmp

Filesize
128KB

Download
memory/912-56-0x0000000000120000-0x000000000012F000-memory.dmp

Filesize
60KB

Download
memory/912-62-0x0000000000120000-0x000000000012F000-memory.dmp

Filesize
60KB

Download