18bf8ccc0287cfa6bb1eba75554cde5fe9d07e3e529871d860bc4fb49829900a

Analysis

max time kernel
121s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 12:25

Target

6e526721b3eb5108c75eb864f01a1b42.dll
Size

251KB
MD5

6e526721b3eb5108c75eb864f01a1b42
SHA1

577118a7357fcd1b4d39e5353a5979a75c3d506a
SHA256

18bf8ccc0287cfa6bb1eba75554cde5fe9d07e3e529871d860bc4fb49829900a
SHA512

2fdcb16f63285f0902f772e9c4ef2b714d1c49f2f9d490c15356da1c3b7e59aaa95ab05b0d3e65cbf66e54a309bc24ee66a11020abc13336adcf110c29dafb69
SSDEEP

6144:0tD/UCqbpDwTGW3nXHyGQcIlkktIDaWcX:a/xqbBwTGg3HIloaWcX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2448	2784	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 2784	1484	rundll32.exe	28
PID 1484 wrote to memory of 2784	1484	rundll32.exe	28
PID 1484 wrote to memory of 2784	1484	rundll32.exe	28
PID 1484 wrote to memory of 2784	1484	rundll32.exe	28
PID 1484 wrote to memory of 2784	1484	rundll32.exe	28
PID 1484 wrote to memory of 2784	1484	rundll32.exe	28
PID 1484 wrote to memory of 2784	1484	rundll32.exe	28
PID 2784 wrote to memory of 2448	2784	rundll32.exe	29
PID 2784 wrote to memory of 2448	2784	rundll32.exe	29
PID 2784 wrote to memory of 2448	2784	rundll32.exe	29
PID 2784 wrote to memory of 2448	2784	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6e526721b3eb5108c75eb864f01a1b42.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6e526721b3eb5108c75eb864f01a1b42.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 272
    3⤵
    - Program crash
    PID:2448