e66ae760b98f57239ece6f0bd37608f5123974ea9a69ab78636a912e70ca3a03

Analysis

max time kernel
100s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
22/04/2023, 22:33

Target

e66ae760b98f57239ece6f0bd37608f5123974ea9a69ab78636a912e70ca3a03.dll
Size

4.0MB
MD5

1c8f04b92ab080511b82cad34cb3252b
SHA1

6d7c96861b789064d9d460627342de3528f9df2f
SHA256

e66ae760b98f57239ece6f0bd37608f5123974ea9a69ab78636a912e70ca3a03
SHA512

d0b26ee1de83cb8ae6b578647b01ef4d4f0ce347a20fe52386bbebe47400d153db65989747bfcd41e39f1d531094d5779d173fbe9320bbe706958ad78b3717fd
SSDEEP

98304:dFgNfLKHcpGsCh+vyU/PukYqBFpO9zaCP5hqzzP8ky+f9DuLGzP:opLDM9RUYqBfO9nP5GIky+f9qLo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1352	1252	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3824 wrote to memory of 1252	3824	rundll32.exe	83
PID 3824 wrote to memory of 1252	3824	rundll32.exe	83
PID 3824 wrote to memory of 1252	3824	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e66ae760b98f57239ece6f0bd37608f5123974ea9a69ab78636a912e70ca3a03.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3824
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e66ae760b98f57239ece6f0bd37608f5123974ea9a69ab78636a912e70ca3a03.dll,#1
  2⤵
  PID:1252
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 628
    3⤵
    - Program crash
    PID:1352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1252 -ip 1252
1⤵
PID:1236

memory/1252-133-0x00000000749E0000-0x0000000075197000-memory.dmp

Filesize
7.7MB

Download