e41eefffb1b5305b60587e6bed75cfc3f4865a20a759a087f624f79cfbe8031e

Analysis

max time kernel
40s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 14:46

Target

e41eefffb1b5305b60587e6bed75cfc3f4865a20a759a087f624f79cfbe8031e.dll
Size

40KB
MD5

d56ea8a67bb01bc894918b7aa5414714
SHA1

a5592cf1ab1f89c12f52bf92a14af9a581cc063e
SHA256

e41eefffb1b5305b60587e6bed75cfc3f4865a20a759a087f624f79cfbe8031e
SHA512

ef7a7bdad177e1c5b92f6db9b77d296e31b714b4c564d3879a4134fe947246f3ea2ad4073410fcce04c6e283aca42e88fc136dc6ef3b07008d937857b4f17462
SSDEEP

384:7oQ7C/MWhFFckCUaq0EY8Ra2NwQyJbtsN4/b:kUCkifzXYXQ8/b

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
112	1076	WerFault.exe	26

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1076	1488	rundll32.exe	26
PID 1488 wrote to memory of 1076	1488	rundll32.exe	26
PID 1488 wrote to memory of 1076	1488	rundll32.exe	26
PID 1488 wrote to memory of 1076	1488	rundll32.exe	26
PID 1488 wrote to memory of 1076	1488	rundll32.exe	26
PID 1488 wrote to memory of 1076	1488	rundll32.exe	26
PID 1488 wrote to memory of 1076	1488	rundll32.exe	26
PID 1076 wrote to memory of 112	1076	rundll32.exe	27
PID 1076 wrote to memory of 112	1076	rundll32.exe	27
PID 1076 wrote to memory of 112	1076	rundll32.exe	27
PID 1076 wrote to memory of 112	1076	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e41eefffb1b5305b60587e6bed75cfc3f4865a20a759a087f624f79cfbe8031e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e41eefffb1b5305b60587e6bed75cfc3f4865a20a759a087f624f79cfbe8031e.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1076
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1076 -s 240
    3⤵
    - Program crash
    PID:112

memory/1076-55-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download