b99aba08a984359703f765f57ea9714232baf2397d774cd8ed81258c1c4896fc

Analysis

max time kernel
38s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
07/12/2022, 23:22

Target
tmpED62.dll
Size 821KB
Sample221207-3clejsge29
SHA256 b99aba08a984359703f765f57ea9714232baf2397d774cd8ed81258c1c4896fc
MD5 78bb5b0c9f7e2d5cabf36deee8941d80
SHA1 c988e68e09364ffbfaafc5036ae98b91144b3aa2
SHA512 5c7e22342a35f963576cdf3a5129a57af7526d2d61ba7fdec6c96014790168f540c810e43180a7f19f3ee86b5bb3c044d972d9783606db1d07b83c1dbfa34c7b
SSDEEP 24576:8VVT+XirpTs7sx0QBnoNjla+idlpdIFyF3N8:QF+uTsAx0tlpidvdkyF3N8
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
308	628	WerFault.exe	17

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 308	628	rundll32.exe	28
PID 628 wrote to memory of 308	628	rundll32.exe	28
PID 628 wrote to memory of 308	628	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\tmpED62.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:628
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 628 -s 84
  2⤵
  - Program crash
  PID:308