4e8d593077b145cab461ec84016d03e5a4802e97196b98ff296c4370693d0cb9

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
17-09-2023 01:34

Target

4e8d593077b145cab461ec84016d03e5a4802e97196b98ff296c4370693d0cb9.dll
Size

218KB
MD5

c5164532fdc2baec9aafd8982ac87bae
SHA1

5c1d13333413bdaba7b192510579a7a684417f5d
SHA256

4e8d593077b145cab461ec84016d03e5a4802e97196b98ff296c4370693d0cb9
SHA512

add3c349748120d98fce6226ea0b01056d54c6af612b10ff830af840f3aac538bd371ad181f1d0de03e327d70d24713f3fcce94c0d303cb99d86226d8618f167
SSDEEP

3072:4fyTFpiSc43UtiD8Umh8I6lk0bF+EjJeNDU2a7i78nifiRjdUKH58YBS:4flD4ktiD8UI8I66C+6AsXnifujF

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1424 1604 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1424	1604	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1696 wrote to memory of 1604	1696	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 1604	1696	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 1604	1696	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 1604	1696	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 1604	1696	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 1604	1696	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 1604	1696	rundll32.exe	rundll32.exe
PID 1604 wrote to memory of 1424	1604	rundll32.exe	WerFault.exe
PID 1604 wrote to memory of 1424	1604	rundll32.exe	WerFault.exe
PID 1604 wrote to memory of 1424	1604	rundll32.exe	WerFault.exe
PID 1604 wrote to memory of 1424	1604	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e8d593077b145cab461ec84016d03e5a4802e97196b98ff296c4370693d0cb9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1696

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e8d593077b145cab461ec84016d03e5a4802e97196b98ff296c4370693d0cb9.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 232
3⤵
- Program crash
PID:1424