3ec26d4e91b0154f4372d2fc24acc0396a601c9986db7299c51ea31a90cb8527

Analysis

max time kernel
40s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-12-2022 02:15

Target

3ec26d4e91b0154f4372d2fc24acc0396a601c9986db7299c51ea31a90cb8527.dll
Size

203KB
MD5

f864e755b044a3ccf7047218dbc53b22
SHA1

295399c78ad812d226d9bc0c21439fdc7a895f51
SHA256

3ec26d4e91b0154f4372d2fc24acc0396a601c9986db7299c51ea31a90cb8527
SHA512

0956578e9651b30e8ee9a469907234a8594cc1916d3a86e4c23bbaf86a35d5f74714c5d0eb0f2ee024870d1c9e01bf97e12a0df8e5bb892bde6930374e831b13
SSDEEP

6144:obVFbLC1wi1/N224cZALI0/FNsOiOiOiOJ6M:ohFbG1/JR0/FNsOiOiOiOQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2004	1360	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 1360	1512	rundll32.exe	27
PID 1512 wrote to memory of 1360	1512	rundll32.exe	27
PID 1512 wrote to memory of 1360	1512	rundll32.exe	27
PID 1512 wrote to memory of 1360	1512	rundll32.exe	27
PID 1512 wrote to memory of 1360	1512	rundll32.exe	27
PID 1512 wrote to memory of 1360	1512	rundll32.exe	27
PID 1512 wrote to memory of 1360	1512	rundll32.exe	27
PID 1360 wrote to memory of 2004	1360	rundll32.exe	28
PID 1360 wrote to memory of 2004	1360	rundll32.exe	28
PID 1360 wrote to memory of 2004	1360	rundll32.exe	28
PID 1360 wrote to memory of 2004	1360	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ec26d4e91b0154f4372d2fc24acc0396a601c9986db7299c51ea31a90cb8527.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ec26d4e91b0154f4372d2fc24acc0396a601c9986db7299c51ea31a90cb8527.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1360
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 236
    3⤵
    - Program crash
    PID:2004

memory/1360-55-0x00000000756A1000-0x00000000756A3000-memory.dmp

Filesize
8KB

Download