6655718d3b33ff0e9c8bab83b6da44d0e026488b284e60116f1b252b5e82620c

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
12-12-2022 09:07

Target

iced2/secgymoddkid/electrofishing.dll
Size

374KB
MD5

84e6e93a8f4b9fd5810052d501cde0ef
SHA1

1be390eeb1fc440f0ac7aae3f3a30406b735e8ae
SHA256

9141d339ec21a8b8c71df0ffa8a205c9d8af4441e74f7548e6847c106c663b23
SHA512

4925461622045335635972396aed2d5a84e47eef590c17521eca6db1f8507698fe880280f2e652bbcd6994ae3bd66e486fc6271e841e01075a4fb07aa6b6989e
SSDEEP

6144:g0FOhm3Y1LfpDqnkIBwcu/oDdzr88vAHL/P27ysDPXoPcTPinEgrTytlRNKIg8g4:g0km3YYY/ohhvAHLnFWPXoPcTPbgrmtn

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

832 1260 WerFault.exe rundll32.exe

pid	pid_target	process	target process
832	1260	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1260 wrote to memory of 832	1260	rundll32.exe	WerFault.exe
PID 1260 wrote to memory of 832	1260	rundll32.exe	WerFault.exe
PID 1260 wrote to memory of 832	1260	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\iced2\secgymoddkid\electrofishing.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1260

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1260 -s 84
2⤵
- Program crash
PID:832