bd609bfe3138d11c3c3afc2e7aa5543592ffb7a67e592ab51f010d04d29f65b4

Analysis

max time kernel
149s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/03/2024, 04:22

Target

e0c2b2f5e646fa0aabf16dde266b6d34.dll
Size

100KB
MD5

e0c2b2f5e646fa0aabf16dde266b6d34
SHA1

bee3e6aa778ac8b61d3d0182b746b512d4d949f2
SHA256

bd609bfe3138d11c3c3afc2e7aa5543592ffb7a67e592ab51f010d04d29f65b4
SHA512

fb4de1bc04eb3c2c0ce9287c06c718224b98afd8e4dd76a7b1db3e772575d056df98d40b9755600ca68af495a5a62a5d4ee7a0703936e8614cafe179cd26d0df
SSDEEP

3072:rgZbSe2TKh0vh51CXTQ7bqcP1yigAzUagYuIn9ql:rgZW9wXslIa+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2320	1724	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 1724	1704	rundll32.exe	28
PID 1704 wrote to memory of 1724	1704	rundll32.exe	28
PID 1704 wrote to memory of 1724	1704	rundll32.exe	28
PID 1704 wrote to memory of 1724	1704	rundll32.exe	28
PID 1704 wrote to memory of 1724	1704	rundll32.exe	28
PID 1704 wrote to memory of 1724	1704	rundll32.exe	28
PID 1704 wrote to memory of 1724	1704	rundll32.exe	28
PID 1724 wrote to memory of 2320	1724	rundll32.exe	29
PID 1724 wrote to memory of 2320	1724	rundll32.exe	29
PID 1724 wrote to memory of 2320	1724	rundll32.exe	29
PID 1724 wrote to memory of 2320	1724	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e0c2b2f5e646fa0aabf16dde266b6d34.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e0c2b2f5e646fa0aabf16dde266b6d34.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 256
    3⤵
    - Program crash
    PID:2320

memory/1724-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download