bee2403020f18e0c73607caadbf5dad6a79ae2eb037fa078476a510f3746a7ca

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 20:27

Target

bee2403020f18e0c73607caadbf5dad6a79ae2eb037fa078476a510f3746a7ca.dll
Size

112KB
MD5

5fe97e6ea9f6fbf6d5bc893b060e2529
SHA1

9da6fd61712a8b92d767ad0396cb19791e254c36
SHA256

bee2403020f18e0c73607caadbf5dad6a79ae2eb037fa078476a510f3746a7ca
SHA512

db341d804f3a1fa56e1d462db4632f6140c2fe22edf4c0d6fca18dad9bb516ccac5be8719da5dd5caccfb6be3b5357a58db3bfa0344ddf80cdb488b896bf9c3e
SSDEEP

3072:+gAG47YsyLGiB4Xu8Q5ddAPbbcSezwU861IO:+gA7YsyyZe4PcVwFc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1788	1848	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 1848	1552	rundll32.exe	28
PID 1552 wrote to memory of 1848	1552	rundll32.exe	28
PID 1552 wrote to memory of 1848	1552	rundll32.exe	28
PID 1552 wrote to memory of 1848	1552	rundll32.exe	28
PID 1552 wrote to memory of 1848	1552	rundll32.exe	28
PID 1552 wrote to memory of 1848	1552	rundll32.exe	28
PID 1552 wrote to memory of 1848	1552	rundll32.exe	28
PID 1848 wrote to memory of 1788	1848	rundll32.exe	29
PID 1848 wrote to memory of 1788	1848	rundll32.exe	29
PID 1848 wrote to memory of 1788	1848	rundll32.exe	29
PID 1848 wrote to memory of 1788	1848	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bee2403020f18e0c73607caadbf5dad6a79ae2eb037fa078476a510f3746a7ca.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bee2403020f18e0c73607caadbf5dad6a79ae2eb037fa078476a510f3746a7ca.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1848
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 248
    3⤵
    - Program crash
    PID:1788

memory/1848-55-0x0000000075241000-0x0000000075243000-memory.dmp

Filesize
8KB

Download