fe5086eba97035f0ebff8dfc2af6a294060bb02f0047f43b0a3d72546fe83437

Analysis

max time kernel
2s
max time network
29s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 10:16

Target

fe5086eba97035f0ebff8dfc2af6a294060bb02f0047f43b0a3d72546fe83437.dll
Size

52KB
MD5

1aee6597c61112056e085fc06b3daa60
SHA1

269fe4eb65ec9bd5cea26200fbf645ae7f68e666
SHA256

fe5086eba97035f0ebff8dfc2af6a294060bb02f0047f43b0a3d72546fe83437
SHA512

6a53b128ac1353a260455a3505c7fd7f69a7d83c63dcfde9f103ac3e43b1f87c497c4ba660475a6477fb3d4c9a40e6cc9831f4521082a3110d62abc491c5044d
SSDEEP

768:lyOYs0Ci3T9qLkIB+0yM1/CWdoYqTjGa4EhRtIQ9hd+HPWVunTEDHA7wjca:lZzi34LkkV/RdoF7ecUHP7ER

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1968	1776	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1776	2040	rundll32.exe	27
PID 2040 wrote to memory of 1776	2040	rundll32.exe	27
PID 2040 wrote to memory of 1776	2040	rundll32.exe	27
PID 2040 wrote to memory of 1776	2040	rundll32.exe	27
PID 2040 wrote to memory of 1776	2040	rundll32.exe	27
PID 2040 wrote to memory of 1776	2040	rundll32.exe	27
PID 2040 wrote to memory of 1776	2040	rundll32.exe	27
PID 1776 wrote to memory of 1968	1776	rundll32.exe	28
PID 1776 wrote to memory of 1968	1776	rundll32.exe	28
PID 1776 wrote to memory of 1968	1776	rundll32.exe	28
PID 1776 wrote to memory of 1968	1776	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe5086eba97035f0ebff8dfc2af6a294060bb02f0047f43b0a3d72546fe83437.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe5086eba97035f0ebff8dfc2af6a294060bb02f0047f43b0a3d72546fe83437.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 224
    3⤵
    - Program crash
    PID:1968

memory/1776-54-0x0000000000000000-mapping.dmp

Download
memory/1776-55-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download
memory/1968-56-0x0000000000000000-mapping.dmp

Download