e1f2bb668455dcc1a85ad36b6b0f40a8bc27f96ca6426772fdc04571c92e72d6

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20230824-en
resource tags

arch:x64arch:x86image:win7-20230824-enlocale:en-usos:windows7-x64system
submitted
30/08/2023, 03:17

Target

e1f2bb668455dcc1a85ad36b6b0f40a8bc27f96ca6426772fdc04571c92e72d6.dll
Size

43KB
MD5

f1783c61f382fe2fa85ddb3e7ca1dbc2
SHA1

4b0e47e7b59bdce182a8214cba5cc25bcab4b0d6
SHA256

e1f2bb668455dcc1a85ad36b6b0f40a8bc27f96ca6426772fdc04571c92e72d6
SHA512

2cedaef06ec45da04125e468bb2e10769e3e7659103db64d29e35b7121aeae98f4abb5bf1b620cff37c20eb4eb595f49088a1f30b4c093a3a2c75e2aac4bb6dc
SSDEEP

768:+XS9GrAt3NhVkNOl2c7e7BlLgLEdYnqc0ABuOEdGPeOB1to3ruhFP7:+2oAt3JiOlFedKnqc0Awr0PRB123ruz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2324	940	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 940	2892	rundll32.exe	30
PID 2892 wrote to memory of 940	2892	rundll32.exe	30
PID 2892 wrote to memory of 940	2892	rundll32.exe	30
PID 2892 wrote to memory of 940	2892	rundll32.exe	30
PID 2892 wrote to memory of 940	2892	rundll32.exe	30
PID 2892 wrote to memory of 940	2892	rundll32.exe	30
PID 2892 wrote to memory of 940	2892	rundll32.exe	30
PID 940 wrote to memory of 2324	940	rundll32.exe	31
PID 940 wrote to memory of 2324	940	rundll32.exe	31
PID 940 wrote to memory of 2324	940	rundll32.exe	31
PID 940 wrote to memory of 2324	940	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e1f2bb668455dcc1a85ad36b6b0f40a8bc27f96ca6426772fdc04571c92e72d6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e1f2bb668455dcc1a85ad36b6b0f40a8bc27f96ca6426772fdc04571c92e72d6.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 940 -s 224
    3⤵
    - Program crash
    PID:2324