e9163dbc6fdcec29b09a26dbb3c88e51236245d1841cd197c59cdd582c7df7ea

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
24-05-2023 16:09

Target

a0UFMZnC6ltxphw.dat.dll
Size

281KB
MD5

294d2e3b30432e0fbbe53aebef27c571
SHA1

21b68fe0cb0e0a028271c99d727dfb57b3201485
SHA256

e9163dbc6fdcec29b09a26dbb3c88e51236245d1841cd197c59cdd582c7df7ea
SHA512

da77c178408f7cc6396cac77ef2cbb753f4bb3a002b26ac93f49bc29bba676811784b14b5611c794e12add3307fec85648b883ad8a0a91664b5c1e9f3925a298
SSDEEP

6144:wnCa7uW+h+IJE+edVtbIDBJF0Ecns6y9cjo2iwJtsykZHqxO34aG30VmXSmzlkRI:W77uEs6T39JDVGF4sjWpx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1136	1056	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 1056	2024	rundll32.exe	28
PID 2024 wrote to memory of 1056	2024	rundll32.exe	28
PID 2024 wrote to memory of 1056	2024	rundll32.exe	28
PID 2024 wrote to memory of 1056	2024	rundll32.exe	28
PID 2024 wrote to memory of 1056	2024	rundll32.exe	28
PID 2024 wrote to memory of 1056	2024	rundll32.exe	28
PID 2024 wrote to memory of 1056	2024	rundll32.exe	28
PID 1056 wrote to memory of 1136	1056	rundll32.exe	29
PID 1056 wrote to memory of 1136	1056	rundll32.exe	29
PID 1056 wrote to memory of 1136	1056	rundll32.exe	29
PID 1056 wrote to memory of 1136	1056	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a0UFMZnC6ltxphw.dat.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a0UFMZnC6ltxphw.dat.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 228
    3⤵
    - Program crash
    PID:1136