8ec3146bbca9855b3a31227bc3a30e64b7a0f3e2e22748f916e45fb5d23d160a

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 00:44

Target

8ec3146bbca9855b3a31227bc3a30e64b7a0f3e2e22748f916e45fb5d23d160a.dll
Size

22KB
MD5

04596d9d31d3f24ee3923c377d1f63f8
SHA1

eae0b66b275b8c5a13bee5f00717bb1627057488
SHA256

8ec3146bbca9855b3a31227bc3a30e64b7a0f3e2e22748f916e45fb5d23d160a
SHA512

a4a7293952e7ee019fed9ce7894140eefaf1a51e34224b67bc8f8c616eee167c61ed4d98ba814a6cf4e2efc82605e200a4bc94b8ba674e12e5443f339219daed
SSDEEP

384:eQ6AAKaXMJhYOJmw/pdmGdj23aix9xmxzAA0uu6g87jK:96AARXMJh7IJfxDmZAA7u6372

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1920	872	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 872	1440	rundll32.exe	28
PID 1440 wrote to memory of 872	1440	rundll32.exe	28
PID 1440 wrote to memory of 872	1440	rundll32.exe	28
PID 1440 wrote to memory of 872	1440	rundll32.exe	28
PID 1440 wrote to memory of 872	1440	rundll32.exe	28
PID 1440 wrote to memory of 872	1440	rundll32.exe	28
PID 1440 wrote to memory of 872	1440	rundll32.exe	28
PID 872 wrote to memory of 1920	872	rundll32.exe	29
PID 872 wrote to memory of 1920	872	rundll32.exe	29
PID 872 wrote to memory of 1920	872	rundll32.exe	29
PID 872 wrote to memory of 1920	872	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8ec3146bbca9855b3a31227bc3a30e64b7a0f3e2e22748f916e45fb5d23d160a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8ec3146bbca9855b3a31227bc3a30e64b7a0f3e2e22748f916e45fb5d23d160a.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 872 -s 204
    3⤵
    - Program crash
    PID:1920

memory/872-55-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download
memory/872-56-0x0000000000130000-0x000000000013C000-memory.dmp

Filesize
48KB

Download