eebd0f2ab7ef40775dea11dbfa57c1b4c671b700a9b89175fe5b11b0c0a27f59

Analysis

max time kernel
22s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 13:32

Target

eebd0f2ab7ef40775dea11dbfa57c1b4c671b700a9b89175fe5b11b0c0a27f59.dll
Size

106KB
MD5

6ae956e793b2b8f16ea402d695b8c660
SHA1

c7d22be8cb35db1c494c4a8e2154055687d96445
SHA256

eebd0f2ab7ef40775dea11dbfa57c1b4c671b700a9b89175fe5b11b0c0a27f59
SHA512

1c1f9326941dff1fe30a8c901c77c50f670472db434e484c35a5d60c226fb4eecec807e116c9dd5370fb86af6c960e835eda98e8e1d182f5ad6f7d08b933d6fe
SSDEEP

3072:Jds7xEm5K7oIzKlkcw+gF48UJpOVnjwZO7:Ts7lG+kdLF4DJpAnjt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1296	1960	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 1960	940	rundll32.exe	28
PID 940 wrote to memory of 1960	940	rundll32.exe	28
PID 940 wrote to memory of 1960	940	rundll32.exe	28
PID 940 wrote to memory of 1960	940	rundll32.exe	28
PID 940 wrote to memory of 1960	940	rundll32.exe	28
PID 940 wrote to memory of 1960	940	rundll32.exe	28
PID 940 wrote to memory of 1960	940	rundll32.exe	28
PID 1960 wrote to memory of 1296	1960	rundll32.exe	29
PID 1960 wrote to memory of 1296	1960	rundll32.exe	29
PID 1960 wrote to memory of 1296	1960	rundll32.exe	29
PID 1960 wrote to memory of 1296	1960	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\eebd0f2ab7ef40775dea11dbfa57c1b4c671b700a9b89175fe5b11b0c0a27f59.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\eebd0f2ab7ef40775dea11dbfa57c1b4c671b700a9b89175fe5b11b0c0a27f59.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1960
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 260
    3⤵
    - Program crash
    PID:1296

memory/1960-55-0x00000000756B1000-0x00000000756B3000-memory.dmp

Filesize
8KB

Download