e4330f55ab4e209df67ba0d14a30d52fd4d8342f974d4d117a99b30f56100b5b

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
02/03/2023, 14:31

Target

e4330f55ab4e209df67ba0d14a30d52fd4d8342f974d4d117a99b30f56100b5b.dll
Size

296KB
MD5

2f19d0ff9cfc6521b7a3ffd2f4a3b026
SHA1

b93b766066132f4bbcc264f52df7bec82af7b47a
SHA256

e4330f55ab4e209df67ba0d14a30d52fd4d8342f974d4d117a99b30f56100b5b
SHA512

7a613c398d0e52cde539c9c869c86a37c71c0d38634d8031f0ecdbce93893d7007e15be4e78bfc83d3f17adaca174b1a726060a1885a63ef8befed45bd5403f9
SSDEEP

6144:gJbcCxXcYkNj1ps3rBbialiubXRVjEo0PohaA:gtcKMYkNj1ps31bxl9hVjERPo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1568	924	WerFault.exe	20

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 1568	924	rundll32.exe	28
PID 924 wrote to memory of 1568	924	rundll32.exe	28
PID 924 wrote to memory of 1568	924	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e4330f55ab4e209df67ba0d14a30d52fd4d8342f974d4d117a99b30f56100b5b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:924
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 924 -s 108
  2⤵
  - Program crash
  PID:1568