e7a298fd1083af65631a9d02994e9118460ab2c6704ef79ab66d71d3f6b6da75

Analysis

max time kernel
38s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 11:21

Target

e7a298fd1083af65631a9d02994e9118460ab2c6704ef79ab66d71d3f6b6da75.dll
Size

800KB
MD5

76e43d647e26d968021a6874560c0fb6
SHA1

198280ab4edd2ad82bc1d82ad90919f27deaeebb
SHA256

e7a298fd1083af65631a9d02994e9118460ab2c6704ef79ab66d71d3f6b6da75
SHA512

ad7639d85de2b3aa9f6bb81bc815c4fd412cccf518db857452f50c14adc1510e61910993cb02eb347c8c6af7dad092ed65c551f91f5247bbdef8773f1dd70a85
SSDEEP

24576:9Ro7D7j1rgH3dQxcBMSkuTCHCRPFwr7t:CKNe/HHiwr

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1340	1852	WerFault.exe	26

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 1852	1424	rundll32.exe	26
PID 1424 wrote to memory of 1852	1424	rundll32.exe	26
PID 1424 wrote to memory of 1852	1424	rundll32.exe	26
PID 1424 wrote to memory of 1852	1424	rundll32.exe	26
PID 1424 wrote to memory of 1852	1424	rundll32.exe	26
PID 1424 wrote to memory of 1852	1424	rundll32.exe	26
PID 1424 wrote to memory of 1852	1424	rundll32.exe	26
PID 1852 wrote to memory of 1340	1852	rundll32.exe	27
PID 1852 wrote to memory of 1340	1852	rundll32.exe	27
PID 1852 wrote to memory of 1340	1852	rundll32.exe	27
PID 1852 wrote to memory of 1340	1852	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e7a298fd1083af65631a9d02994e9118460ab2c6704ef79ab66d71d3f6b6da75.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e7a298fd1083af65631a9d02994e9118460ab2c6704ef79ab66d71d3f6b6da75.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1852
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 228
    3⤵
    - Program crash
    PID:1340

memory/1340-56-0x0000000000000000-mapping.dmp

Download
memory/1852-54-0x0000000000000000-mapping.dmp

Download
memory/1852-55-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download