c09d86efdc1486de2dd00fdc8900ee9efc307017369b3900ce7b35e708dfcc50

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-03-2024 12:23

Target

e1a8e6f7d491a137584b40ca852494b8.dll
Size

127KB
MD5

e1a8e6f7d491a137584b40ca852494b8
SHA1

d7267ef81df252efe517e43730863739720c5d38
SHA256

c09d86efdc1486de2dd00fdc8900ee9efc307017369b3900ce7b35e708dfcc50
SHA512

3157e1ba4099fcdbb0ad9b59e2bd4a9439ee4bb97aa5b21ab36ca39978dd76d1850c38d2c280a9010d6f53a812aeb1478782a80f2eea2d54e2520fefcc87e608
SSDEEP

1536:h+sRWd4nhueU5u2s1N/47TVWeBeu644kPOLD38lKHPEryZ21uZjYCBA3MpM7c8uI:5sURE3VW8POLwlKb21uRYCuLMF6ejk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2944	2136	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 2136	640	rundll32.exe	28
PID 640 wrote to memory of 2136	640	rundll32.exe	28
PID 640 wrote to memory of 2136	640	rundll32.exe	28
PID 640 wrote to memory of 2136	640	rundll32.exe	28
PID 640 wrote to memory of 2136	640	rundll32.exe	28
PID 640 wrote to memory of 2136	640	rundll32.exe	28
PID 640 wrote to memory of 2136	640	rundll32.exe	28
PID 2136 wrote to memory of 2944	2136	rundll32.exe	29
PID 2136 wrote to memory of 2944	2136	rundll32.exe	29
PID 2136 wrote to memory of 2944	2136	rundll32.exe	29
PID 2136 wrote to memory of 2944	2136	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e1a8e6f7d491a137584b40ca852494b8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e1a8e6f7d491a137584b40ca852494b8.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 224
    3⤵
    - Program crash
    PID:2944