ebc63f98c08553965eaab4b08e3bd0d5e1f66747be6b103eaf9462103a0c5e59

Analysis

max time kernel
10s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 12:33

Target

ebc63f98c08553965eaab4b08e3bd0d5e1f66747be6b103eaf9462103a0c5e59.dll
Size

204KB
MD5

ac00de3679b8fcd414b0da4908de4720
SHA1

70c83f3aed568844fb545ce19b4ef5ffd9d78d04
SHA256

ebc63f98c08553965eaab4b08e3bd0d5e1f66747be6b103eaf9462103a0c5e59
SHA512

01841f358db3fed89d0d0efa8b8af400b3a16ed3b566feb687e80fb9ec0853ad482209b89118fdcbf8ea6e61eadf2deefa4339abec85628fe90c9a301b9671b2
SSDEEP

3072:6eiMiBX7iWtXpdyDIYiD0cx3JXNbWqcZK3VYYHS/c2RhvmA0qHRcO5Vnk1XD6qmy:Amm7x5MZAHT6JuL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1104	2008	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 2008	1076	rundll32.exe	28
PID 1076 wrote to memory of 2008	1076	rundll32.exe	28
PID 1076 wrote to memory of 2008	1076	rundll32.exe	28
PID 1076 wrote to memory of 2008	1076	rundll32.exe	28
PID 1076 wrote to memory of 2008	1076	rundll32.exe	28
PID 1076 wrote to memory of 2008	1076	rundll32.exe	28
PID 1076 wrote to memory of 2008	1076	rundll32.exe	28
PID 2008 wrote to memory of 1104	2008	rundll32.exe	29
PID 2008 wrote to memory of 1104	2008	rundll32.exe	29
PID 2008 wrote to memory of 1104	2008	rundll32.exe	29
PID 2008 wrote to memory of 1104	2008	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ebc63f98c08553965eaab4b08e3bd0d5e1f66747be6b103eaf9462103a0c5e59.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ebc63f98c08553965eaab4b08e3bd0d5e1f66747be6b103eaf9462103a0c5e59.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 268
    3⤵
    - Program crash
    PID:1104

memory/2008-55-0x0000000076AE1000-0x0000000076AE3000-memory.dmp

Filesize
8KB

Download