eba3ab156455b5537e314c01b25787d8ba33498ae73b1939e2db356bf0fada1b

Analysis

max time kernel
33s
max time network
67s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 12:34

Target

eba3ab156455b5537e314c01b25787d8ba33498ae73b1939e2db356bf0fada1b.dll
Size

204KB
MD5

270192d919bc31d3c27b20b178614c20
SHA1

ac824bfafb4f4d9c669069535b8df4a0c4c89189
SHA256

eba3ab156455b5537e314c01b25787d8ba33498ae73b1939e2db356bf0fada1b
SHA512

056137cc88e1ead660dd73e92759b5957a520b13b287ba0c68034cc6e313186af9f1f7676c74654f8e804560104c198af7d2845a9a4d74fd1e00bd2d1eac9127
SSDEEP

3072:rTicIBf71WKzGdyDI+4LmhcuHJghbGrHkRalooMSscWRzPmg0qHRcO5VndxWNGew:+ppmupnkRKeWNGYO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
908	1860	WerFault.exe	26

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1860	2020	rundll32.exe	26
PID 2020 wrote to memory of 1860	2020	rundll32.exe	26
PID 2020 wrote to memory of 1860	2020	rundll32.exe	26
PID 2020 wrote to memory of 1860	2020	rundll32.exe	26
PID 2020 wrote to memory of 1860	2020	rundll32.exe	26
PID 2020 wrote to memory of 1860	2020	rundll32.exe	26
PID 2020 wrote to memory of 1860	2020	rundll32.exe	26
PID 1860 wrote to memory of 908	1860	rundll32.exe	27
PID 1860 wrote to memory of 908	1860	rundll32.exe	27
PID 1860 wrote to memory of 908	1860	rundll32.exe	27
PID 1860 wrote to memory of 908	1860	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\eba3ab156455b5537e314c01b25787d8ba33498ae73b1939e2db356bf0fada1b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\eba3ab156455b5537e314c01b25787d8ba33498ae73b1939e2db356bf0fada1b.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 268
    3⤵
    - Program crash
    PID:908

memory/1860-55-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download