e07e3082d973a6a3accb92e19b1083fb6b8021e1445859cb10e7a62f4d0a1a3a

Analysis

max time kernel
93s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
23/04/2023, 06:24

Target

e07e3082d973a6a3accb92e19b1083fb6b8021e1445859cb10e7a62f4d0a1a3a.dll
Size

4.0MB
MD5

e1b5a8ba60742723cd7b61e053f7c593
SHA1

d47b2d1b9ad1aec99ef86e3357eebd74dbda5848
SHA256

e07e3082d973a6a3accb92e19b1083fb6b8021e1445859cb10e7a62f4d0a1a3a
SHA512

043851899b982bfcd9cbd3e0432cc0a7b8e98a66aad61f2995cff1f50dd30884bb233a1f9291aa3523fbf073fe34d7b2e628979397d83a2c61e6425e50d0ccd3
SSDEEP

98304:dFgNfLKHcpGsCh+vyU/PukYqBFpO9zaCP5hqzzP8ky+f9DuLGzm:opLDM9RUYqBfO9nP5GIky+f9qLB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2232	4608	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 4608	4944	rundll32.exe	84
PID 4944 wrote to memory of 4608	4944	rundll32.exe	84
PID 4944 wrote to memory of 4608	4944	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e07e3082d973a6a3accb92e19b1083fb6b8021e1445859cb10e7a62f4d0a1a3a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e07e3082d973a6a3accb92e19b1083fb6b8021e1445859cb10e7a62f4d0a1a3a.dll,#1
  2⤵
  PID:4608
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4608 -s 628
    3⤵
    - Program crash
    PID:2232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4608 -ip 4608
1⤵
PID:4668

memory/4608-133-0x0000000074F30000-0x00000000756E7000-memory.dmp

Filesize
7.7MB

Download