f843df4408e9719d8fd984d3623b764f7bb7632e982c314c4672663a98c0774d

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 20:35

Target

e6ce76af2634b540d649b38f6668e6ca.dll
Size

99KB
MD5

e6ce76af2634b540d649b38f6668e6ca
SHA1

257b01d1e896ef5d8542bc9f727ae60c0b8add18
SHA256

f843df4408e9719d8fd984d3623b764f7bb7632e982c314c4672663a98c0774d
SHA512

acd32edcb14d985959d247a9bb0daf6897fa28200e884f1eb95cb1e56f0271ad68e120d6eebdb52420251d62ccbc0e39b11a55a39587fd4ac00ce2c6b77a9866
SSDEEP

1536:yvY651yStniw1SRb9vQf9YxliNIvWGaFLY3mbSrsWJ/cdy0UCWptvJ:Gh15tioS9vuSiNVmmbLy09WptJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2816	2772	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2772	2008	rundll32.exe	28
PID 2008 wrote to memory of 2772	2008	rundll32.exe	28
PID 2008 wrote to memory of 2772	2008	rundll32.exe	28
PID 2008 wrote to memory of 2772	2008	rundll32.exe	28
PID 2008 wrote to memory of 2772	2008	rundll32.exe	28
PID 2008 wrote to memory of 2772	2008	rundll32.exe	28
PID 2008 wrote to memory of 2772	2008	rundll32.exe	28
PID 2772 wrote to memory of 2816	2772	rundll32.exe	29
PID 2772 wrote to memory of 2816	2772	rundll32.exe	29
PID 2772 wrote to memory of 2816	2772	rundll32.exe	29
PID 2772 wrote to memory of 2816	2772	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e6ce76af2634b540d649b38f6668e6ca.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e6ce76af2634b540d649b38f6668e6ca.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 220
    3⤵
    - Program crash
    PID:2816