ecda30eaafd691488a6e62d602acdcb4c24bcbdb6a1cb9c1bdaa13f0a5b5a8d8

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14-10-2023 03:59

Target

ecda30eaafd691488a6e62d602acdcb4c24bcbdb6a1cb9c1bdaa13f0a5b5a8d8.dll
Size

208KB
MD5

8f251e8b2afcf46b764dbfef86df3126
SHA1

e11bf2b0c91d469edac7945dcf037558b201a1db
SHA256

ecda30eaafd691488a6e62d602acdcb4c24bcbdb6a1cb9c1bdaa13f0a5b5a8d8
SHA512

c93a66ce4be2cc3735f16caff83c80074b0ce6897c411981b97f5a6e90e2bd4bdb3f3e8e24506a841656e953998860b5f27c078e614f4572e78612bdf3a0b0e2
SSDEEP

3072:LI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdUyY5O:LIDff9D8C6XYRw6MT2DEj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2196 2188 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2196	2188	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1696 wrote to memory of 2188	1696	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 2188	1696	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 2188	1696	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 2188	1696	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 2188	1696	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 2188	1696	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 2188	1696	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 2196	2188	rundll32.exe	WerFault.exe
PID 2188 wrote to memory of 2196	2188	rundll32.exe	WerFault.exe
PID 2188 wrote to memory of 2196	2188	rundll32.exe	WerFault.exe
PID 2188 wrote to memory of 2196	2188	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ecda30eaafd691488a6e62d602acdcb4c24bcbdb6a1cb9c1bdaa13f0a5b5a8d8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ecda30eaafd691488a6e62d602acdcb4c24bcbdb6a1cb9c1bdaa13f0a5b5a8d8.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 232
    3⤵
    - Program crash
    PID:2196