3be4ec0c0b3a209f19208f2a27865a92352a4ccd69e07350cc8027a88d97ed95

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
03/01/2024, 15:10

Target

3eb216d2ebf01ac8023989c46ae1a77b.dll
Size

185KB
MD5

3eb216d2ebf01ac8023989c46ae1a77b
SHA1

a2894b32ce95ddde399f839fbaf1a77876de321b
SHA256

3be4ec0c0b3a209f19208f2a27865a92352a4ccd69e07350cc8027a88d97ed95
SHA512

1d992be9321b13962a3077ea254a1031fbdbd5678e734c5c2ea8f5073170d961873fa6af39761435631fdff54bb0436878c287faee35e865b535d64b93e8d5ee
SSDEEP

3072:hzZFhBECT5NsBY7rhGya9wmpCs3rfbTTBftoNA5nQwbQoNsBY7rhGm:phBEClSBY/hGhWIrDTTBloNA5ngoSBYx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2316	2064	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 2064	1960	rundll32.exe	15
PID 1960 wrote to memory of 2064	1960	rundll32.exe	15
PID 1960 wrote to memory of 2064	1960	rundll32.exe	15
PID 1960 wrote to memory of 2064	1960	rundll32.exe	15
PID 1960 wrote to memory of 2064	1960	rundll32.exe	15
PID 1960 wrote to memory of 2064	1960	rundll32.exe	15
PID 1960 wrote to memory of 2064	1960	rundll32.exe	15
PID 2064 wrote to memory of 2316	2064	rundll32.exe	14
PID 2064 wrote to memory of 2316	2064	rundll32.exe	14
PID 2064 wrote to memory of 2316	2064	rundll32.exe	14
PID 2064 wrote to memory of 2316	2064	rundll32.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 232
1⤵
- Program crash
PID:2316

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3eb216d2ebf01ac8023989c46ae1a77b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2064

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3eb216d2ebf01ac8023989c46ae1a77b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1960