7e6c4f31583c0959a868d29819f8a321d6bd91cf156e33f0ff5f01941806731a

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 10:34

Target

7e6c4f31583c0959a868d29819f8a321d6bd91cf156e33f0ff5f01941806731a.exe
Size

1.0MB
MD5

01c40d63b3d1f09c8dfd5304c0c7899b
SHA1

1d9622ccf4c8edac550b4bcec1bd25704dd5a935
SHA256

7e6c4f31583c0959a868d29819f8a321d6bd91cf156e33f0ff5f01941806731a
SHA512

30e7116d8b2508ca30bd44baa12fc635125de94a3ef80bf4dfb2cc5f58975388f3e9fac22e13e6ded0ecb9e106d9fb97b2d502fc50b638590453b5985355f75c
SSDEEP

24576:tAG44O+mNHCMibw5nPODTlDYJJRZKSG9JOx4xnY1K:tT4WmNdMuO/OnKLJO+i1

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

5072 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4604 3484 WerFault.exe 7e6c4f31583c0959a868d29819f8a321d6bd91cf156e33f0ff5f01941806731a.exe

pid	process
5072	rundll32.exe

pid	pid_target	process	target process
4604	3484	WerFault.exe	7e6c4f31583c0959a868d29819f8a321d6bd91cf156e33f0ff5f01941806731a.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

7e6c4f31583c0959a868d29819f8a321d6bd91cf156e33f0ff5f01941806731a.exe

description	pid	process	target process
PID 3484 wrote to memory of 5072	3484	7e6c4f31583c0959a868d29819f8a321d6bd91cf156e33f0ff5f01941806731a.exe	rundll32.exe
PID 3484 wrote to memory of 5072	3484	7e6c4f31583c0959a868d29819f8a321d6bd91cf156e33f0ff5f01941806731a.exe	rundll32.exe
PID 3484 wrote to memory of 5072	3484	7e6c4f31583c0959a868d29819f8a321d6bd91cf156e33f0ff5f01941806731a.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\7e6c4f31583c0959a868d29819f8a321d6bd91cf156e33f0ff5f01941806731a.exe
"C:\Users\Admin\AppData\Local\Temp\7e6c4f31583c0959a868d29819f8a321d6bd91cf156e33f0ff5f01941806731a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3484

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Uayqupoehp.tmp",Rrptfe
2⤵
- Loads dropped DLL
PID:5072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3484 -s 520
2⤵
- Program crash
PID:4604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3484 -ip 3484
1⤵
PID:2932

C:\Users\Admin\AppData\Local\Temp\Uayqupoehp.tmp
Filesize
774KB

MD5
d5e88f35e214f2dff51a7d494316bac2

SHA1
6306dfa71c4e32dede210631cf90732693c0afcf

SHA256
f1828a7b26be78bb27df25b98762eb7dd7e49ee8582d5eee42ded05b0eebc1e4

SHA512
ff167f0379173f976e3f91f41f6c88e67b12dfb0386b66d19f78d3aa3f11534cf2ce1c1d753ada0133cf291adca7ad8367087b791a5c05eaf371dd877ebcce1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Uayqupoehp.tmp
Filesize
774KB

MD5
d5e88f35e214f2dff51a7d494316bac2

SHA1
6306dfa71c4e32dede210631cf90732693c0afcf

SHA256
f1828a7b26be78bb27df25b98762eb7dd7e49ee8582d5eee42ded05b0eebc1e4

SHA512
ff167f0379173f976e3f91f41f6c88e67b12dfb0386b66d19f78d3aa3f11534cf2ce1c1d753ada0133cf291adca7ad8367087b791a5c05eaf371dd877ebcce1d

Download Submit
memory/3484-132-0x0000000002486000-0x0000000002567000-memory.dmp

Filesize
900KB

Download
memory/3484-133-0x00000000025D0000-0x00000000026F5000-memory.dmp

Filesize
1.1MB

Download
memory/3484-137-0x0000000000400000-0x000000000071E000-memory.dmp

Filesize
3.1MB

Download
memory/3484-138-0x00000000025D0000-0x00000000026F5000-memory.dmp

Filesize
1.1MB

Download
memory/5072-134-0x0000000000000000-mapping.dmp

Download