e21c9b47594ee77595f2639afee9b36e44610c20d7ad32b78212ebefb84c9684

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
09-01-2023 20:22

Target

e21c9b47594ee77595f2639afee9b36e44610c20d7ad32b78212ebefb84c9684.dll
Size

60KB
MD5

798f05d2bb5ab62fa751bd42e131f80b
SHA1

d1709725ddb27840cbe60c358cbc461d16f856a3
SHA256

e21c9b47594ee77595f2639afee9b36e44610c20d7ad32b78212ebefb84c9684
SHA512

c477e7d5e702d159eaa878634a6aaec5abad186ecc2ba9e065811d31fc95afe34291c74cf53dc24487e37cc7943712d31d4c30cbd3947b07c6dee65204e26b8e
SSDEEP

768:hO4apg9TJD/UFPvh45g1WmxValWf5uJMj9TX8Vd76o1x6:hHT+4mjw4IdZx

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1788 1540 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1788	1540	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1540 wrote to memory of 1788	1540	rundll32.exe	WerFault.exe
PID 1540 wrote to memory of 1788	1540	rundll32.exe	WerFault.exe
PID 1540 wrote to memory of 1788	1540	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e21c9b47594ee77595f2639afee9b36e44610c20d7ad32b78212ebefb84c9684.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1540 -s 56
  2⤵
  - Program crash
  PID:1788