9ef5a6843ed183b9c907ceaf8598029f1c94c8be401088677991c2745391b8c3

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
18/12/2022, 18:54

Target

9ef5a6843ed183b9c907ceaf8598029f1c94c8be401088677991c2745391b8c3.dll
Size

488KB
MD5

2bf14aa9ac641ea5d51c3cea1e59785e
SHA1

812a6486e2c24d6f3ad9e507738c26047778ffbf
SHA256

9ef5a6843ed183b9c907ceaf8598029f1c94c8be401088677991c2745391b8c3
SHA512

b90e51ef9f1fb6a6e7c2b0d9fbd733c2ad02b8cf0b4b8ae0476b23411db4be42a807876862cd652926b07cf14bfe17df1addb048ed560adef72fd960726e7f8f
SSDEEP

12288:4oDwZY8r3ByhULvTiIeYcdG3NUGQFjPb9K1:KdduULv13NUGQFH9K1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1108	1220	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 1220	1068	rundll32.exe	28
PID 1068 wrote to memory of 1220	1068	rundll32.exe	28
PID 1068 wrote to memory of 1220	1068	rundll32.exe	28
PID 1068 wrote to memory of 1220	1068	rundll32.exe	28
PID 1068 wrote to memory of 1220	1068	rundll32.exe	28
PID 1068 wrote to memory of 1220	1068	rundll32.exe	28
PID 1068 wrote to memory of 1220	1068	rundll32.exe	28
PID 1220 wrote to memory of 1108	1220	rundll32.exe	29
PID 1220 wrote to memory of 1108	1220	rundll32.exe	29
PID 1220 wrote to memory of 1108	1220	rundll32.exe	29
PID 1220 wrote to memory of 1108	1220	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ef5a6843ed183b9c907ceaf8598029f1c94c8be401088677991c2745391b8c3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ef5a6843ed183b9c907ceaf8598029f1c94c8be401088677991c2745391b8c3.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1220
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1220 -s 228
    3⤵
    - Program crash
    PID:1108

memory/1220-55-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download