ed78a3006281aa03b57c72baf76b32fe37a2038e5993d42221ec1ff4d3acf442

Analysis

max time kernel
33s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 12:46

Target

ed78a3006281aa03b57c72baf76b32fe37a2038e5993d42221ec1ff4d3acf442.dll
Size

395KB
MD5

7c87f462348731706f4d7f283f996620
SHA1

c13fda3d65318b669c1e6eab738df1d61ec84517
SHA256

ed78a3006281aa03b57c72baf76b32fe37a2038e5993d42221ec1ff4d3acf442
SHA512

68cb341510bd3590b88af02ce107f4650812ed5fd6215279edb2a6e10373af02015d10d3899beb2b9908354f528bb03e49566c8e8e04261c4a0ce6a11f78ee83
SSDEEP

6144:GjCNcMDIoSyTG1LzSTFI1ub50l2GWXID0caDUa2BfFdLhxiYu68uq+XW9lODn:L0L4G5zWmAGYW3fF1ziYu2q+GXm

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

852 1968 WerFault.exe rundll32.exe

pid	pid_target	process	target process
852	1968	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2000 wrote to memory of 1968	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 1968	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 1968	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 1968	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 1968	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 1968	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 1968	2000	rundll32.exe	rundll32.exe
PID 1968 wrote to memory of 852	1968	rundll32.exe	WerFault.exe
PID 1968 wrote to memory of 852	1968	rundll32.exe	WerFault.exe
PID 1968 wrote to memory of 852	1968	rundll32.exe	WerFault.exe
PID 1968 wrote to memory of 852	1968	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ed78a3006281aa03b57c72baf76b32fe37a2038e5993d42221ec1ff4d3acf442.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2000

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ed78a3006281aa03b57c72baf76b32fe37a2038e5993d42221ec1ff4d3acf442.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 232
3⤵
- Program crash
PID:852

memory/852-61-0x0000000000000000-mapping.dmp

Download
memory/1968-54-0x0000000000000000-mapping.dmp

Download
memory/1968-55-0x00000000754E1000-0x00000000754E3000-memory.dmp

Filesize
8KB

Download
memory/1968-56-0x0000000000730000-0x0000000000796000-memory.dmp

Filesize
408KB

Download
memory/1968-60-0x0000000000260000-0x00000000002C2000-memory.dmp

Filesize
392KB

Download