8de152ee3fe8804423b7cb9335f5209544d3bcc0eb6dbff3f60555893d5c6696

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
09-01-2023 20:22

Target

8de152ee3fe8804423b7cb9335f5209544d3bcc0eb6dbff3f60555893d5c6696.dll
Size

60KB
MD5

286cf5c57228fa9e4f7902df95f50149
SHA1

c0b0f7dd51745cb07544059b00927aaf9317ec17
SHA256

8de152ee3fe8804423b7cb9335f5209544d3bcc0eb6dbff3f60555893d5c6696
SHA512

8ce23bfc3cfb8e080afec66488e28b725ca7c93c1ad7bdeb8757775b47e7abd90d37f9c5ac7ca3a244bcecc49a2a2bee0ba1548d08cb3ad466fda285863b83ec
SSDEEP

768:hO4apg9TJD/UFPvh45g1WmxValWf5uJMj9TX8Vd76o1x6:hHT+4mjw4IdZx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1888	1160	WerFault.exe	19

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 1888	1160	rundll32.exe	28
PID 1160 wrote to memory of 1888	1160	rundll32.exe	28
PID 1160 wrote to memory of 1888	1160	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8de152ee3fe8804423b7cb9335f5209544d3bcc0eb6dbff3f60555893d5c6696.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1160 -s 56
  2⤵
  - Program crash
  PID:1888