209113be716dd92ebbc8da1c9aa8bb22adfda1da32e168055f3a56b1ddc0bbd5

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
23/01/2024, 23:55

Target

ExtensionManager.dll
Size

81KB
MD5

1abcbd1332cde96fbd79df5f2e0a263d
SHA1

9c2576487c7339921f8daf8aa645636c94099bdb
SHA256

e80b1c88d10b363379c51fbb0834f7ca03606383d9e739c5d391f513747f7670
SHA512

f6bdf4fc1f4b329095a7917fdc720312dafc925194164113ce1b5bbdfd2c957d6caeec8a63d02f82adb88ea1de83d9964867432cb71f18ec1c860e81e986404d
SSDEEP

1536:mSoF8WR2QNMLtynGN9MKo2ckNtbC2UXkph1U2zTrJLqh3jS:mSsvWoGY4tbJ7ugTrJLq0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2516	2176	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2176	2196	rundll32.exe	28
PID 2196 wrote to memory of 2176	2196	rundll32.exe	28
PID 2196 wrote to memory of 2176	2196	rundll32.exe	28
PID 2196 wrote to memory of 2176	2196	rundll32.exe	28
PID 2196 wrote to memory of 2176	2196	rundll32.exe	28
PID 2196 wrote to memory of 2176	2196	rundll32.exe	28
PID 2196 wrote to memory of 2176	2196	rundll32.exe	28
PID 2176 wrote to memory of 2516	2176	rundll32.exe	29
PID 2176 wrote to memory of 2516	2176	rundll32.exe	29
PID 2176 wrote to memory of 2516	2176	rundll32.exe	29
PID 2176 wrote to memory of 2516	2176	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExtensionManager.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExtensionManager.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 224
    3⤵
    - Program crash
    PID:2516