e2d018872db60c419d6e6593e1b7adcc434d4de6f5472ec2201130d147158e63

Analysis

max time kernel
40s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 06:28

Target

e2d018872db60c419d6e6593e1b7adcc434d4de6f5472ec2201130d147158e63.dll
Size

329KB
MD5

460d7e1d5f5c212726fdc252c5ee2d40
SHA1

68564ac6947f51479809011e9d949f38a43fe6ce
SHA256

e2d018872db60c419d6e6593e1b7adcc434d4de6f5472ec2201130d147158e63
SHA512

5f1898527e4f3c76999f72eef4c363ea2845e1e6bf25a7f5c1893e7ce64c3a543acdaa9a46d2fa219585b5c7ecd672ef86aebfa84419ef3dbd6040f7f5b6f1ea
SSDEEP

6144:kWPUYuocYYUx9/SovHo9ZYQeeaQee43QeesQeewJQeehQeeKshBZVvFxCM4sb:HPUYuz3Ux1Sxyhbgo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1948	1568	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 1568	968	rundll32.exe	27
PID 968 wrote to memory of 1568	968	rundll32.exe	27
PID 968 wrote to memory of 1568	968	rundll32.exe	27
PID 968 wrote to memory of 1568	968	rundll32.exe	27
PID 968 wrote to memory of 1568	968	rundll32.exe	27
PID 968 wrote to memory of 1568	968	rundll32.exe	27
PID 968 wrote to memory of 1568	968	rundll32.exe	27
PID 1568 wrote to memory of 1948	1568	rundll32.exe	28
PID 1568 wrote to memory of 1948	1568	rundll32.exe	28
PID 1568 wrote to memory of 1948	1568	rundll32.exe	28
PID 1568 wrote to memory of 1948	1568	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e2d018872db60c419d6e6593e1b7adcc434d4de6f5472ec2201130d147158e63.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e2d018872db60c419d6e6593e1b7adcc434d4de6f5472ec2201130d147158e63.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1568
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 404
    3⤵
    - Program crash
    PID:1948

memory/1568-55-0x0000000076831000-0x0000000076833000-memory.dmp

Filesize
8KB

Download