ec173466aa78f728cbe9af8d982e251096f80eb81f7f35a577b582a6321c1802

Analysis

max time kernel
84s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 12:47

Target

ec173466aa78f728cbe9af8d982e251096f80eb81f7f35a577b582a6321c1802.dll
Size

126KB
MD5

38740f3503fa016efd52c3972825de46
SHA1

2d6b390597a1d140144169d98985dc078c6c36cd
SHA256

ec173466aa78f728cbe9af8d982e251096f80eb81f7f35a577b582a6321c1802
SHA512

4954c507f5256575e483076edb08dd30cef465e4f0908a0c9d27ca1fface8caae2f3a5a3a394e27f33b9396d7fb7bf67a31b4db78bfb3dc6e802c49530f13ace
SSDEEP

1536:wyI7cejgyB8H1WNWts2093DRpQrT954SVvNIIxifw6c/tnleRZrJ5im7lw:pI7cyu1W13DkxpvNII0f8/RyrJXq

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

588 1032 WerFault.exe rundll32.exe

pid	pid_target	process	target process
588	1032	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1000 wrote to memory of 1032	1000	rundll32.exe	rundll32.exe
PID 1000 wrote to memory of 1032	1000	rundll32.exe	rundll32.exe
PID 1000 wrote to memory of 1032	1000	rundll32.exe	rundll32.exe
PID 1000 wrote to memory of 1032	1000	rundll32.exe	rundll32.exe
PID 1000 wrote to memory of 1032	1000	rundll32.exe	rundll32.exe
PID 1000 wrote to memory of 1032	1000	rundll32.exe	rundll32.exe
PID 1000 wrote to memory of 1032	1000	rundll32.exe	rundll32.exe
PID 1032 wrote to memory of 588	1032	rundll32.exe	WerFault.exe
PID 1032 wrote to memory of 588	1032	rundll32.exe	WerFault.exe
PID 1032 wrote to memory of 588	1032	rundll32.exe	WerFault.exe
PID 1032 wrote to memory of 588	1032	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ec173466aa78f728cbe9af8d982e251096f80eb81f7f35a577b582a6321c1802.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1000

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ec173466aa78f728cbe9af8d982e251096f80eb81f7f35a577b582a6321c1802.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 228
3⤵
- Program crash
PID:588

memory/588-62-0x0000000000000000-mapping.dmp

Download
memory/1032-54-0x0000000000000000-mapping.dmp

Download
memory/1032-55-0x0000000075441000-0x0000000075443000-memory.dmp

Filesize
8KB

Download
memory/1032-56-0x00000000001B0000-0x00000000001C0000-memory.dmp

Filesize
64KB

Download
memory/1032-57-0x0000000000210000-0x0000000000232000-memory.dmp

Filesize
136KB

Download
memory/1032-61-0x0000000010000000-0x0000000010022000-memory.dmp

Filesize
136KB

Download
memory/1032-63-0x00000000001B0000-0x00000000001C0000-memory.dmp

Filesize
64KB

Download