ee146134a939160ecdd1679dce19c6a64655cc2feabac858f8ee580a9e174c00

Analysis

max time kernel
25s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 17:57

Target

ee146134a939160ecdd1679dce19c6a64655cc2feabac858f8ee580a9e174c00.dll
Size

1.0MB
MD5

4b40c3bd96f0ff104b225b3a19b84058
SHA1

83f1787afdec061e03799b228e9ea8460d15afcc
SHA256

ee146134a939160ecdd1679dce19c6a64655cc2feabac858f8ee580a9e174c00
SHA512

22df6b132b82f2ff9e8556a5ca1f91a56d224a8c64e881e255759e5fbd0d94e5cdc179d99246df3596a8b5af6098a882a0dfaefd7ac30d714af86e37b3d3918a
SSDEEP

24576:y14ZK3qAbf5qNXuKUmsos4iuWmQf2W1nMkPyZ0v+lAT3T:6qP7q1nLr

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
980	1680	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 1680	1664	rundll32.exe	28
PID 1664 wrote to memory of 1680	1664	rundll32.exe	28
PID 1664 wrote to memory of 1680	1664	rundll32.exe	28
PID 1664 wrote to memory of 1680	1664	rundll32.exe	28
PID 1664 wrote to memory of 1680	1664	rundll32.exe	28
PID 1664 wrote to memory of 1680	1664	rundll32.exe	28
PID 1664 wrote to memory of 1680	1664	rundll32.exe	28
PID 1680 wrote to memory of 980	1680	rundll32.exe	29
PID 1680 wrote to memory of 980	1680	rundll32.exe	29
PID 1680 wrote to memory of 980	1680	rundll32.exe	29
PID 1680 wrote to memory of 980	1680	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ee146134a939160ecdd1679dce19c6a64655cc2feabac858f8ee580a9e174c00.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ee146134a939160ecdd1679dce19c6a64655cc2feabac858f8ee580a9e174c00.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 296
    3⤵
    - Program crash
    PID:980

memory/1680-55-0x0000000075FB1000-0x0000000075FB3000-memory.dmp

Filesize
8KB

Download
memory/1680-56-0x0000000000A30000-0x0000000000B45000-memory.dmp

Filesize
1.1MB

Download