8eae30c35dec44f6fab0b8b50b693e0ddc0726434d3727409209df7a1f78fadf

Analysis

max time kernel
1s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 12:50

Target

8eae30c35dec44f6fab0b8b50b693e0ddc0726434d3727409209df7a1f78fadf.dll
Size

33KB
MD5

2d0db769c9cd99b3dc324fac02d6ed67
SHA1

bcfd92c257a8bcc4018d4b477bce8e2c99d0d1b6
SHA256

8eae30c35dec44f6fab0b8b50b693e0ddc0726434d3727409209df7a1f78fadf
SHA512

45fae0563ab8322df2440619ff8c36ba5ea108f2e484d883d3fcbc3996f42bca67a4e342b2f12938a10b4f7519d6b44c25cf0c5d8adea22aecbacee3eb9cc208
SSDEEP

384:Y6zW6rxrcgyaynNhnGH9IbNq9m0x+EuPjuJ1oXkpzvl6JR/W:9egIN0IZqY0x+EijuJ1oXktvl

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1472	956	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 972 wrote to memory of 956	972	rundll32.exe	28
PID 972 wrote to memory of 956	972	rundll32.exe	28
PID 972 wrote to memory of 956	972	rundll32.exe	28
PID 972 wrote to memory of 956	972	rundll32.exe	28
PID 972 wrote to memory of 956	972	rundll32.exe	28
PID 972 wrote to memory of 956	972	rundll32.exe	28
PID 972 wrote to memory of 956	972	rundll32.exe	28
PID 956 wrote to memory of 1472	956	rundll32.exe	29
PID 956 wrote to memory of 1472	956	rundll32.exe	29
PID 956 wrote to memory of 1472	956	rundll32.exe	29
PID 956 wrote to memory of 1472	956	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8eae30c35dec44f6fab0b8b50b693e0ddc0726434d3727409209df7a1f78fadf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8eae30c35dec44f6fab0b8b50b693e0ddc0726434d3727409209df7a1f78fadf.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:956
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 956 -s 240
    3⤵
    - Program crash
    PID:1472

memory/956-55-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download