221e8eb425440d4930863d9db326b99374959028253d68739e545123105e1a92

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
25/02/2024, 10:32

Target

221e8eb425440d4930863d9db326b99374959028253d68739e545123105e1a92.dll
Size

1.4MB
MD5

e18eb3f977a53cd1aecbb06d5e007fc3
SHA1

0212eb04e9578dab964e50df6b056cd6e9c2a110
SHA256

221e8eb425440d4930863d9db326b99374959028253d68739e545123105e1a92
SHA512

41e6bbc7c62a9059453f5379968c70a8fed5b6ac60bc2693f1574c8a756cc5a43d24299f8fd4a74277b75589842309b3820350bfde693a1687e1b6dd7d3a6ebe
SSDEEP

24576:2lSLiRPiZ6CC/AhTWHP1hvR+jyHvx3/nGNAKBe9M07YhSFtC7IQdxKHTtyRXeluT:uSLiRP3CC4BYvRNvx3Q6d0ho47xaiXie

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
864	1292	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1292	1636	rundll32.exe	28
PID 1636 wrote to memory of 1292	1636	rundll32.exe	28
PID 1636 wrote to memory of 1292	1636	rundll32.exe	28
PID 1636 wrote to memory of 1292	1636	rundll32.exe	28
PID 1636 wrote to memory of 1292	1636	rundll32.exe	28
PID 1636 wrote to memory of 1292	1636	rundll32.exe	28
PID 1636 wrote to memory of 1292	1636	rundll32.exe	28
PID 1292 wrote to memory of 864	1292	rundll32.exe	29
PID 1292 wrote to memory of 864	1292	rundll32.exe	29
PID 1292 wrote to memory of 864	1292	rundll32.exe	29
PID 1292 wrote to memory of 864	1292	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\221e8eb425440d4930863d9db326b99374959028253d68739e545123105e1a92.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\221e8eb425440d4930863d9db326b99374959028253d68739e545123105e1a92.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1292
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1292 -s 228
    3⤵
    - Program crash
    PID:864