e7f9da1f714f4fd985b3e073d9e79c54326fda7c820c4a483ca9542cb5bd4de6

Analysis

max time kernel
91s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 13:02

Target

e7f9da1f714f4fd985b3e073d9e79c54326fda7c820c4a483ca9542cb5bd4de6.dll
Size

947KB
MD5

0c00cb91b766562b265e79b12a2efa3a
SHA1

06813041c1a6351d5ddb49f2acfca5966e0c3982
SHA256

e7f9da1f714f4fd985b3e073d9e79c54326fda7c820c4a483ca9542cb5bd4de6
SHA512

62fe097efbfc6aaee1c6bb15a95116e82421611ad7760c5f8ccc389a35d5a9c82d999047c46980c9105674ce161b17b368402ae570f1c2e0433c23f8a8e1dab5
SSDEEP

24576:txlOpjL3Y/pSskHKGb7TIh31e0EG+PlZ+y+imz1:1snoBSskqGb7TIZ1e0E1z+5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2424	1824	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1824	1720	rundll32.exe	83
PID 1720 wrote to memory of 1824	1720	rundll32.exe	83
PID 1720 wrote to memory of 1824	1720	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e7f9da1f714f4fd985b3e073d9e79c54326fda7c820c4a483ca9542cb5bd4de6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e7f9da1f714f4fd985b3e073d9e79c54326fda7c820c4a483ca9542cb5bd4de6.dll,#1
  2⤵
  PID:1824
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 756
    3⤵
    - Program crash
    PID:2424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1824 -ip 1824
1⤵
PID:2236

memory/1824-133-0x0000000002110000-0x00000000023F5000-memory.dmp

Filesize
2.9MB

Download
memory/1824-134-0x00000000007D0000-0x00000000007D4000-memory.dmp

Filesize
16KB

Download
memory/1824-135-0x0000000002110000-0x00000000023F5000-memory.dmp

Filesize
2.9MB

Download
memory/1824-136-0x0000000002110000-0x00000000023F5000-memory.dmp

Filesize
2.9MB

Download