1e2b05838edfb0460fc97e2d7bab2271891c55ca0c895d4db30cf2acfaea51d2

Analysis

max time kernel
128s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
08/03/2023, 12:49

Target

1e2b05838edfb0460fc97e2d7bab2271891c55ca0c895d4db30cf2acfaea51d2.dll
Size

37KB
MD5

53cfc99ee275af52e9dde06292083879
SHA1

a3ad99efaa4c896976e3861fd5b8ec173bb10228
SHA256

1e2b05838edfb0460fc97e2d7bab2271891c55ca0c895d4db30cf2acfaea51d2
SHA512

f881dd32db969374bf45a6b13b526b5f8bfe7aeb9d395f9e6fcc19076173a578348354814d6688153be24d78eaea8ca2549dd64abf6128f39dc921f36b9899ae
SSDEEP

384:lz698uLGPWE/8azdJkX3aqPBr0frtMFpRrEVhUXMWlPK+1nu6EDHd7E/12C7vyxM:3X8aiKfhe3OhjyimnTEDW7vydv8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
928	1692	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1692	2040	rundll32.exe	28
PID 2040 wrote to memory of 1692	2040	rundll32.exe	28
PID 2040 wrote to memory of 1692	2040	rundll32.exe	28
PID 2040 wrote to memory of 1692	2040	rundll32.exe	28
PID 2040 wrote to memory of 1692	2040	rundll32.exe	28
PID 2040 wrote to memory of 1692	2040	rundll32.exe	28
PID 2040 wrote to memory of 1692	2040	rundll32.exe	28
PID 1692 wrote to memory of 928	1692	rundll32.exe	29
PID 1692 wrote to memory of 928	1692	rundll32.exe	29
PID 1692 wrote to memory of 928	1692	rundll32.exe	29
PID 1692 wrote to memory of 928	1692	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e2b05838edfb0460fc97e2d7bab2271891c55ca0c895d4db30cf2acfaea51d2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e2b05838edfb0460fc97e2d7bab2271891c55ca0c895d4db30cf2acfaea51d2.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 224
    3⤵
    - Program crash
    PID:928

memory/1692-55-0x0000000074570000-0x000000007457D000-memory.dmp

Filesize
52KB

Download
memory/1692-54-0x0000000074580000-0x000000007458D000-memory.dmp

Filesize
52KB

Download
memory/1692-57-0x0000000074580000-0x000000007458D000-memory.dmp

Filesize
52KB

Download
memory/1692-56-0x0000000074580000-0x000000007458D000-memory.dmp

Filesize
52KB

Download