e039181765850d9d681acfa6e936282211b15601d37791fcdb7ebf1f32297009

Analysis

max time kernel
121s
max time network
135s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 05:24

Target

e039181765850d9d681acfa6e936282211b15601d37791fcdb7ebf1f32297009.dll
Size

2.8MB
MD5

f2aefe9be195cd38df050f7e2a691d1c
SHA1

dc496ff722716cef6812d5d753323f297ace9c96
SHA256

e039181765850d9d681acfa6e936282211b15601d37791fcdb7ebf1f32297009
SHA512

dc932054ee0ef77d42c7983fb0d7b931b7aedf31401a0f655fc34bd0b443c92f2f6f01107b8a7e1151296ef5e724586c23809dce6f8d19b77b28b095b3eb1cf3
SSDEEP

49152:88bvd1uf1VJM7NnaUhEehiArugE+T5i9F8n/Y5X8Tl/TjEccFsUVUP3OO0:TbFgf1DsaUhEgiAKx0i9Fm/xEccsP3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2420	2416	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2416	2220	rundll32.exe	28
PID 2220 wrote to memory of 2416	2220	rundll32.exe	28
PID 2220 wrote to memory of 2416	2220	rundll32.exe	28
PID 2220 wrote to memory of 2416	2220	rundll32.exe	28
PID 2220 wrote to memory of 2416	2220	rundll32.exe	28
PID 2220 wrote to memory of 2416	2220	rundll32.exe	28
PID 2220 wrote to memory of 2416	2220	rundll32.exe	28
PID 2416 wrote to memory of 2420	2416	rundll32.exe	29
PID 2416 wrote to memory of 2420	2416	rundll32.exe	29
PID 2416 wrote to memory of 2420	2416	rundll32.exe	29
PID 2416 wrote to memory of 2420	2416	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e039181765850d9d681acfa6e936282211b15601d37791fcdb7ebf1f32297009.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e039181765850d9d681acfa6e936282211b15601d37791fcdb7ebf1f32297009.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 260
    3⤵
    - Program crash
    PID:2420