7ea3224dbec7edf8333210ec8f9e9a1fef699cfe0914412cbbff816acbeb2beb

Analysis

max time kernel
119s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 20:59

Target

7ea3224dbec7edf8333210ec8f9e9a1fef699cfe0914412cbbff816acbeb2beb.dll
Size

144KB
MD5

0d3a67708a32941f49d91ced76a4456a
SHA1

a1546ea2fcd6f546b6d6634b87a472964ea7f787
SHA256

7ea3224dbec7edf8333210ec8f9e9a1fef699cfe0914412cbbff816acbeb2beb
SHA512

f92d058312118ff40a3bfc26cd39f7889df2ee910027c9b5460d3cef59f608b4977dc8cbfce4630537abc0d2c4705f6ffff4bf511e04415d8ec2662544d577ce
SSDEEP

3072:jT4Hx9ZMit5k8r0xAZ/YJGU+Cnm9puxAxmxAWQmx3Ktf:H4R9ZM4cxopH/C4mxAWV1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1712	4348	WerFault.exe	78

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 4348	1268	rundll32.exe	78
PID 1268 wrote to memory of 4348	1268	rundll32.exe	78
PID 1268 wrote to memory of 4348	1268	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ea3224dbec7edf8333210ec8f9e9a1fef699cfe0914412cbbff816acbeb2beb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ea3224dbec7edf8333210ec8f9e9a1fef699cfe0914412cbbff816acbeb2beb.dll,#1
  2⤵
  PID:4348
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4348 -s 572
    3⤵
    - Program crash
    PID:1712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4348 -ip 4348
1⤵
PID:1616