e72f8eb2629b3a92e0108aaf90b0ccf25a2a2117d2ea14df0b24bb314382be35

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
20-10-2023 06:06

Target

e72f8eb2629b3a92e0108aaf90b0ccf25a2a2117d2ea14df0b24bb314382be35.dll
Size

208KB
MD5

28fa796a706ea75cd6dda75221341905
SHA1

de7618358caa1a87e4ffd47705ba765d3feb8a73
SHA256

e72f8eb2629b3a92e0108aaf90b0ccf25a2a2117d2ea14df0b24bb314382be35
SHA512

d2a1fb33bf3994d524a6154d90fd84a320066ece9c4e94f70a192eb81d2ae4bc6e8edc0b6d442b2db64130663db3f265ffc89261be159dcf77a59ef492af497b
SSDEEP

3072:LI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdUovY59:LIDff9D8C6XYRw6MT2DEjV

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1268 2248 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1268	2248	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2216 wrote to memory of 2248	2216	rundll32.exe	rundll32.exe
PID 2216 wrote to memory of 2248	2216	rundll32.exe	rundll32.exe
PID 2216 wrote to memory of 2248	2216	rundll32.exe	rundll32.exe
PID 2216 wrote to memory of 2248	2216	rundll32.exe	rundll32.exe
PID 2216 wrote to memory of 2248	2216	rundll32.exe	rundll32.exe
PID 2216 wrote to memory of 2248	2216	rundll32.exe	rundll32.exe
PID 2216 wrote to memory of 2248	2216	rundll32.exe	rundll32.exe
PID 2248 wrote to memory of 1268	2248	rundll32.exe	WerFault.exe
PID 2248 wrote to memory of 1268	2248	rundll32.exe	WerFault.exe
PID 2248 wrote to memory of 1268	2248	rundll32.exe	WerFault.exe
PID 2248 wrote to memory of 1268	2248	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e72f8eb2629b3a92e0108aaf90b0ccf25a2a2117d2ea14df0b24bb314382be35.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e72f8eb2629b3a92e0108aaf90b0ccf25a2a2117d2ea14df0b24bb314382be35.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2248 -s 232
    3⤵
    - Program crash
    PID:1268