e9b89cc44f6dd0ca297dff1fce6d214d2092ac3b0ae6ec50577945c336ae9803

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22/04/2023, 23:09

Target

e9b89cc44f6dd0ca297dff1fce6d214d2092ac3b0ae6ec50577945c336ae9803.dll
Size

4.0MB
MD5

fffa6a0679fabbd887e1290f443fdeaf
SHA1

af82a5e819a8392d3a68ac0aeb9f9f4956d4f721
SHA256

e9b89cc44f6dd0ca297dff1fce6d214d2092ac3b0ae6ec50577945c336ae9803
SHA512

03a95333deebf1af078034b678e95035eff8108358676d6608625b4f63e1910a36460b8b518b1d05ac7d5bf6e4d73d665802a7d2f697d95f43b37ddf2bf5087c
SSDEEP

98304:dFgNfLKHcpGsCh+vyU/PukYqBFpO9zaCP5hqzzP8ky+f9DuLGzD:opLDM9RUYqBfO9nP5GIky+f9qLA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1992	912	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 912	1400	rundll32.exe	27
PID 1400 wrote to memory of 912	1400	rundll32.exe	27
PID 1400 wrote to memory of 912	1400	rundll32.exe	27
PID 1400 wrote to memory of 912	1400	rundll32.exe	27
PID 1400 wrote to memory of 912	1400	rundll32.exe	27
PID 1400 wrote to memory of 912	1400	rundll32.exe	27
PID 1400 wrote to memory of 912	1400	rundll32.exe	27
PID 912 wrote to memory of 1992	912	rundll32.exe	28
PID 912 wrote to memory of 1992	912	rundll32.exe	28
PID 912 wrote to memory of 1992	912	rundll32.exe	28
PID 912 wrote to memory of 1992	912	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e9b89cc44f6dd0ca297dff1fce6d214d2092ac3b0ae6ec50577945c336ae9803.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e9b89cc44f6dd0ca297dff1fce6d214d2092ac3b0ae6ec50577945c336ae9803.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 912 -s 248
    3⤵
    - Program crash
    PID:1992

memory/912-54-0x0000000073A20000-0x00000000741D7000-memory.dmp

Filesize
7.7MB

Download