8de152ee3fe8804423b7cb9335f5209544d3bcc0eb6dbff3f60555893d5c6696

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
09/01/2023, 20:22

Target
8de152ee3fe8804423b7cb9335f5209544d3bcc0eb6dbff3f60555893d5c6696.dll
Size 60KB
Sample230109-y51bysff43
SHA256 8de152ee3fe8804423b7cb9335f5209544d3bcc0eb6dbff3f60555893d5c6696
MD5 286cf5c57228fa9e4f7902df95f50149
SHA1 c0b0f7dd51745cb07544059b00927aaf9317ec17
SHA512 8ce23bfc3cfb8e080afec66488e28b725ca7c93c1ad7bdeb8757775b47e7abd90d37f9c5ac7ca3a244bcecc49a2a2bee0ba1548d08cb3ad466fda285863b83ec
SSDEEP 768:hO4apg9TJD/UFPvh45g1WmxValWf5uJMj9TX8Vd76o1x6:hHT+4mjw4IdZx
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1888	1160	WerFault.exe	19

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 1888	1160	rundll32.exe	28
PID 1160 wrote to memory of 1888	1160	rundll32.exe	28
PID 1160 wrote to memory of 1888	1160	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8de152ee3fe8804423b7cb9335f5209544d3bcc0eb6dbff3f60555893d5c6696.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1160 -s 56
  2⤵
  - Program crash
  PID:1888