ed525a5dc3d722a1b833ea42e7f2c0b401c8139420cd3a060d871e849960abc5

Analysis

max time kernel
118s
max time network
134s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
26-10-2023 23:05

Target

ed525a5dc3d722a1b833ea42e7f2c0b401c8139420cd3a060d871e849960abc5.dll
Size

208KB
MD5

c1edf14cafdd9c8b5ecbcc6bfd26881a
SHA1

41aea453ebdbad798045c6f36349b3eb61bc2040
SHA256

ed525a5dc3d722a1b833ea42e7f2c0b401c8139420cd3a060d871e849960abc5
SHA512

5dadbc360215034872470077abad695dcc74f8de7b1790a862a4afb16b095aae45e9c6b88b64a0ced40398dbf9d2e2288cac6af97082a339de99c756752243ac
SSDEEP

3072:cI6CqRCxffkClZ8Cyn7LQlRw6x+Y3CxT2DtK5jdUWY5:cIDff9D8CEXYRw6MT2DEj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3056 1900 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3056	1900	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2284 wrote to memory of 1900	2284	rundll32.exe	rundll32.exe
PID 2284 wrote to memory of 1900	2284	rundll32.exe	rundll32.exe
PID 2284 wrote to memory of 1900	2284	rundll32.exe	rundll32.exe
PID 2284 wrote to memory of 1900	2284	rundll32.exe	rundll32.exe
PID 2284 wrote to memory of 1900	2284	rundll32.exe	rundll32.exe
PID 2284 wrote to memory of 1900	2284	rundll32.exe	rundll32.exe
PID 2284 wrote to memory of 1900	2284	rundll32.exe	rundll32.exe
PID 1900 wrote to memory of 3056	1900	rundll32.exe	WerFault.exe
PID 1900 wrote to memory of 3056	1900	rundll32.exe	WerFault.exe
PID 1900 wrote to memory of 3056	1900	rundll32.exe	WerFault.exe
PID 1900 wrote to memory of 3056	1900	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ed525a5dc3d722a1b833ea42e7f2c0b401c8139420cd3a060d871e849960abc5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2284

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ed525a5dc3d722a1b833ea42e7f2c0b401c8139420cd3a060d871e849960abc5.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 232
3⤵
- Program crash
PID:3056