2ba51d7e338242bc6a8109317b91dd13137e296693c535ceacc1288775acc81f

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
03/06/2023, 14:42

Target

2ba51d7e338242bc6a8109317b91dd13137e296693c535ceacc1288775acc81f.dll
Size

687KB
MD5

46ac4b26d35f619d8a1415b5e4365a52
SHA1

607275dd0dd4e29542ef1a2c97475379a2e37cb8
SHA256

2ba51d7e338242bc6a8109317b91dd13137e296693c535ceacc1288775acc81f
SHA512

1e3665da61fff9d938f429e37c47237bc0c5364777965936225bb8c84b2889f4b5ce3cf63155f1f674513349178204ac3a5187d578b039481698c6b8f4e8a2e6
SSDEEP

12288:e6h6TOEPTCJIiuLeJIAcLoHZAbmu9U4+wx26lhagO10yW6D+fa3P3oG:e6d6lhagOayXD+fEP3H

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1972	2008	WerFault.exe	26

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1972	2008	rundll32.exe	27
PID 2008 wrote to memory of 1972	2008	rundll32.exe	27
PID 2008 wrote to memory of 1972	2008	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ba51d7e338242bc6a8109317b91dd13137e296693c535ceacc1288775acc81f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2008 -s 92
  2⤵
  - Program crash
  PID:1972