ea5bea35948f76f7efe00f1d899fe2f681a731034386f21f0047042c72562a6c

Analysis

max time kernel
3s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 09:26

Target

ea5bea35948f76f7efe00f1d899fe2f681a731034386f21f0047042c72562a6c.dll
Size

29KB
MD5

1026afdd79971f43e23c9507a51a5b78
SHA1

c62d0d228a5b9b87fcf67bfadc350dc4b4575dd0
SHA256

ea5bea35948f76f7efe00f1d899fe2f681a731034386f21f0047042c72562a6c
SHA512

6a601641ac7e73cc3632598660b6df2faad5de075fb749bfe60d2908d88609a6d17d06ffa8f920bca976b53214ca45ecc6b703210b5bf480a3a8ab0e2c4aba41
SSDEEP

384:3AUBNoCuWT/Gef7RNzAulkasEej6Rn/NJR5uxy/Hqs91vZIU:QUACfT3dNEbaJeG1JRL1vZI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
564	2032	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2032	2028	rundll32.exe	28
PID 2028 wrote to memory of 2032	2028	rundll32.exe	28
PID 2028 wrote to memory of 2032	2028	rundll32.exe	28
PID 2028 wrote to memory of 2032	2028	rundll32.exe	28
PID 2028 wrote to memory of 2032	2028	rundll32.exe	28
PID 2028 wrote to memory of 2032	2028	rundll32.exe	28
PID 2028 wrote to memory of 2032	2028	rundll32.exe	28
PID 2032 wrote to memory of 564	2032	rundll32.exe	29
PID 2032 wrote to memory of 564	2032	rundll32.exe	29
PID 2032 wrote to memory of 564	2032	rundll32.exe	29
PID 2032 wrote to memory of 564	2032	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ea5bea35948f76f7efe00f1d899fe2f681a731034386f21f0047042c72562a6c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ea5bea35948f76f7efe00f1d899fe2f681a731034386f21f0047042c72562a6c.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 228
    3⤵
    - Program crash
    PID:564

memory/2032-55-0x0000000074FD1000-0x0000000074FD3000-memory.dmp

Filesize
8KB

Download