2ed6e7ec16e2a65459d4d77a0f06c8f757d03969a0dd640932c2f90507952baf

Analysis

max time kernel
29s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
16-05-2023 02:05

Target

aeaTJIW6xt.dll
Size

358KB
MD5

386029008d6aa807e1a6ce146737dd36
SHA1

5b2ed6b356cd4faf46a68a4824c411abfc4834de
SHA256

2ed6e7ec16e2a65459d4d77a0f06c8f757d03969a0dd640932c2f90507952baf
SHA512

86d2891b600f8dd267ce48bec8bb397779cb09d8d77783a48c992df7dd250870f8ee8625e26bf0aecad6adc1173b9a671b86604448730b858cb39c0f2ddbfce9
SSDEEP

6144:a/D0Hb7UDqr1yb1tux77q/Mt12SF7GhUdHMGMIvHQgx77QxxgHb9VnpTBJjT8UZu:oD0Hb7L1yb1tux77q/MW6uIvwO77cgH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
280	1648	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 1648	1832	rundll32.exe	28
PID 1832 wrote to memory of 1648	1832	rundll32.exe	28
PID 1832 wrote to memory of 1648	1832	rundll32.exe	28
PID 1832 wrote to memory of 1648	1832	rundll32.exe	28
PID 1832 wrote to memory of 1648	1832	rundll32.exe	28
PID 1832 wrote to memory of 1648	1832	rundll32.exe	28
PID 1832 wrote to memory of 1648	1832	rundll32.exe	28
PID 1648 wrote to memory of 280	1648	rundll32.exe	29
PID 1648 wrote to memory of 280	1648	rundll32.exe	29
PID 1648 wrote to memory of 280	1648	rundll32.exe	29
PID 1648 wrote to memory of 280	1648	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aeaTJIW6xt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\aeaTJIW6xt.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 228
    3⤵
    - Program crash
    PID:280