6ea427d60dd0e7de38f8577ac75ce1138c73d9f903a1f08aeed7cefaeb8f3ade

Analysis

max time kernel
39s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 18:09

Target

6ea427d60dd0e7de38f8577ac75ce1138c73d9f903a1f08aeed7cefaeb8f3ade.dll
Size

160KB
MD5

e5a9bca06714ee76211157421a4da570
SHA1

6ab3482db06e4020f788831d4212cbe2e35573ff
SHA256

6ea427d60dd0e7de38f8577ac75ce1138c73d9f903a1f08aeed7cefaeb8f3ade
SHA512

5f99bc1edb11ed4d29fd7597d6a7303aa7893c7fc0ff1ed622107c752ec39d37986b46a0e2fea369f15c9d02efa75391c0a09aebeb4727a0f1b0e8340c591e33
SSDEEP

3072:xuhE6zRkHRcgnS892mMcYmxOHr1u/9av/CO15Y:xuh6RcDk8zlAO/C5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1320	1056	WerFault.exe	26

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 1056	1088	rundll32.exe	26
PID 1088 wrote to memory of 1056	1088	rundll32.exe	26
PID 1088 wrote to memory of 1056	1088	rundll32.exe	26
PID 1088 wrote to memory of 1056	1088	rundll32.exe	26
PID 1088 wrote to memory of 1056	1088	rundll32.exe	26
PID 1088 wrote to memory of 1056	1088	rundll32.exe	26
PID 1088 wrote to memory of 1056	1088	rundll32.exe	26
PID 1056 wrote to memory of 1320	1056	rundll32.exe	27
PID 1056 wrote to memory of 1320	1056	rundll32.exe	27
PID 1056 wrote to memory of 1320	1056	rundll32.exe	27
PID 1056 wrote to memory of 1320	1056	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ea427d60dd0e7de38f8577ac75ce1138c73d9f903a1f08aeed7cefaeb8f3ade.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ea427d60dd0e7de38f8577ac75ce1138c73d9f903a1f08aeed7cefaeb8f3ade.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 272
    3⤵
    - Program crash
    PID:1320

memory/1056-55-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download