3be0458c8ecdf5412233baa522c40d37ff606ddf8435f5ce84114ac82c2ddaed

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230824-en
resource tags

arch:x64arch:x86image:win7-20230824-enlocale:en-usos:windows7-x64system
submitted
26/08/2023, 12:49

Target

3be0458c8ecdf5412233baa522c40d37ff606ddf8435f5ce84114ac82c2ddaed.dll
Size

5.5MB
MD5

b0f0f17339e445bb2b6fc8b2f95cfaff
SHA1

e8f6c33e61ef736b3ef0a7c5a1d546c5c5c5b80c
SHA256

3be0458c8ecdf5412233baa522c40d37ff606ddf8435f5ce84114ac82c2ddaed
SHA512

e0684c91d1929888d53596d6c69845540454b6056ecee464de1af94e81b7e5d1e38feef70c63acad89049a80ca1e63d2556dc49e769d18097232217c4329d8a0
SSDEEP

98304:JusYTWLexlJyFJ3gBACUQrd+JeoFr+C3rBTgtbY2KcNw8oVfIAlRk4KLNWeUFV7j:UsYXxlM7e/wlT0yGTlj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1292	572	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 572	2276	rundll32.exe	30
PID 2276 wrote to memory of 572	2276	rundll32.exe	30
PID 2276 wrote to memory of 572	2276	rundll32.exe	30
PID 2276 wrote to memory of 572	2276	rundll32.exe	30
PID 2276 wrote to memory of 572	2276	rundll32.exe	30
PID 2276 wrote to memory of 572	2276	rundll32.exe	30
PID 2276 wrote to memory of 572	2276	rundll32.exe	30
PID 572 wrote to memory of 1292	572	rundll32.exe	31
PID 572 wrote to memory of 1292	572	rundll32.exe	31
PID 572 wrote to memory of 1292	572	rundll32.exe	31
PID 572 wrote to memory of 1292	572	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3be0458c8ecdf5412233baa522c40d37ff606ddf8435f5ce84114ac82c2ddaed.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3be0458c8ecdf5412233baa522c40d37ff606ddf8435f5ce84114ac82c2ddaed.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 572 -s 248
    3⤵
    - Program crash
    PID:1292