e7c5d85b9e665f0e4076b49fd46c8602841ce753f691c3355966dd307b27305e

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 03:53

Target

51fa4b27ac4ca4311ca758958c851b2e.dll
Size

32KB
MD5

51fa4b27ac4ca4311ca758958c851b2e
SHA1

4ed46b1eb4102ffd98da5eef5b5d1b05282f1a68
SHA256

e7c5d85b9e665f0e4076b49fd46c8602841ce753f691c3355966dd307b27305e
SHA512

5bf1a91aef846c607da2f433316c7425279c86346e64b227660283ccde19e2d1a762a24199c8da6e314a5d743f51bc61638b54b97e485c987d0a1fce8819f8b6
SSDEEP

384:lIhlrTB2IZJbl2AFUnLvAiejU4/v86ifvjayU/i:SLloAmoYk6w

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1376	3056	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 3056	1216	rundll32.exe	28
PID 1216 wrote to memory of 3056	1216	rundll32.exe	28
PID 1216 wrote to memory of 3056	1216	rundll32.exe	28
PID 1216 wrote to memory of 3056	1216	rundll32.exe	28
PID 1216 wrote to memory of 3056	1216	rundll32.exe	28
PID 1216 wrote to memory of 3056	1216	rundll32.exe	28
PID 1216 wrote to memory of 3056	1216	rundll32.exe	28
PID 3056 wrote to memory of 1376	3056	rundll32.exe	29
PID 3056 wrote to memory of 1376	3056	rundll32.exe	29
PID 3056 wrote to memory of 1376	3056	rundll32.exe	29
PID 3056 wrote to memory of 1376	3056	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\51fa4b27ac4ca4311ca758958c851b2e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\51fa4b27ac4ca4311ca758958c851b2e.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 196
    3⤵
    - Program crash
    PID:1376