eebd0f2ab7ef40775dea11dbfa57c1b4c671b700a9b89175fe5b11b0c0a27f59

Analysis

max time kernel
137s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 13:32

Target

eebd0f2ab7ef40775dea11dbfa57c1b4c671b700a9b89175fe5b11b0c0a27f59.dll
Size

106KB
MD5

6ae956e793b2b8f16ea402d695b8c660
SHA1

c7d22be8cb35db1c494c4a8e2154055687d96445
SHA256

eebd0f2ab7ef40775dea11dbfa57c1b4c671b700a9b89175fe5b11b0c0a27f59
SHA512

1c1f9326941dff1fe30a8c901c77c50f670472db434e484c35a5d60c226fb4eecec807e116c9dd5370fb86af6c960e835eda98e8e1d182f5ad6f7d08b933d6fe
SSDEEP

3072:Jds7xEm5K7oIzKlkcw+gF48UJpOVnjwZO7:Ts7lG+kdLF4DJpAnjt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4880	2524	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 2524	2436	rundll32.exe	81
PID 2436 wrote to memory of 2524	2436	rundll32.exe	81
PID 2436 wrote to memory of 2524	2436	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\eebd0f2ab7ef40775dea11dbfa57c1b4c671b700a9b89175fe5b11b0c0a27f59.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\eebd0f2ab7ef40775dea11dbfa57c1b4c671b700a9b89175fe5b11b0c0a27f59.dll,#1
  2⤵
  PID:2524
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 660
    3⤵
    - Program crash
    PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 2524 -ip 2524
1⤵
PID:4924