e563cc777061f1943dd92cb64af239768ea3de201c8d422646d5931125d03697

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
09-11-2023 18:45

Target

e563cc777061f1943dd92cb64af239768ea3de201c8d422646d5931125d03697.dll
Size

208KB
MD5

33de9886a686b2b863a6e5a97a867b69
SHA1

f25dfc6390a54bf2ac51afadb135e52057536160
SHA256

e563cc777061f1943dd92cb64af239768ea3de201c8d422646d5931125d03697
SHA512

298a5e89e00b96619e6e45fe90905dbacead0262f0659ef54ebf53c6def3fd215f96f7fc674d263e3adbbcd931ff55001e225bafe460c5e0946f415e2c73135c
SSDEEP

3072:LI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdULY57mcj:LIDff9D8C6XYRw6MT2DEj4cj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2460 2148 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2460	2148	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2360 wrote to memory of 2148	2360	rundll32.exe	rundll32.exe
PID 2360 wrote to memory of 2148	2360	rundll32.exe	rundll32.exe
PID 2360 wrote to memory of 2148	2360	rundll32.exe	rundll32.exe
PID 2360 wrote to memory of 2148	2360	rundll32.exe	rundll32.exe
PID 2360 wrote to memory of 2148	2360	rundll32.exe	rundll32.exe
PID 2360 wrote to memory of 2148	2360	rundll32.exe	rundll32.exe
PID 2360 wrote to memory of 2148	2360	rundll32.exe	rundll32.exe
PID 2148 wrote to memory of 2460	2148	rundll32.exe	WerFault.exe
PID 2148 wrote to memory of 2460	2148	rundll32.exe	WerFault.exe
PID 2148 wrote to memory of 2460	2148	rundll32.exe	WerFault.exe
PID 2148 wrote to memory of 2460	2148	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e563cc777061f1943dd92cb64af239768ea3de201c8d422646d5931125d03697.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2360

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e563cc777061f1943dd92cb64af239768ea3de201c8d422646d5931125d03697.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 232
3⤵
- Program crash
PID:2460