ef3df06d0305bfab33636b9e4b3429a10c81bcd365779805ce4658a8d05e1324

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
16-08-2023 13:24

Target

ef3df06d0305bfab33636b9e4b3429a10c81bcd365779805ce4658a8d05e1324.dll
Size

284KB
MD5

60de5d85b9ec0d0ff02710d87f652214
SHA1

13cc342855b795e1b30112f816eba2cfb6c9a288
SHA256

ef3df06d0305bfab33636b9e4b3429a10c81bcd365779805ce4658a8d05e1324
SHA512

a30972a818eae0a25bcfd04de0cb47d7d93bba353977c09a6b27d012a595487bcfdec75f525fbe8c3b0f873220cda14778959afad932eb10041aa34df3b12069
SSDEEP

6144:4Gh3jIzURqHSY2fITiprXp6dBIsOaa3DaxFoh+6PPPP4:4Gh3MoRPY2wqp6rOMo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1020	2244	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 1020	2244	rundll32.exe	28
PID 2244 wrote to memory of 1020	2244	rundll32.exe	28
PID 2244 wrote to memory of 1020	2244	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ef3df06d0305bfab33636b9e4b3429a10c81bcd365779805ce4658a8d05e1324.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2244 -s 364
  2⤵
  - Program crash
  PID:1020