ae7e7b9c652bf97f2279b4456dd66686c1cfc4493bdafba261c0d6809c920074

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
01-05-2024 14:27

Target

ae7e7b9c652bf97f2279b4456dd66686c1cfc4493bdafba261c0d6809c920074.dll
Size

86KB
MD5

3aa8a7f60cae58b5f4b773f9014e445d
SHA1

81f39b11fb1227fef85d828a181ee027d1239c86
SHA256

ae7e7b9c652bf97f2279b4456dd66686c1cfc4493bdafba261c0d6809c920074
SHA512

77ced25b69e4d7eebf3d4fde91e043e33dd61b7bdb54e4d540cc345f740924f0d3ace7e221f3c6253d500094864367a7b6c647c552ff8484b6236c1530b7b51e
SSDEEP

384:IWhu3qYKJ/UJeo2NVrr47vCWqLFOCvYVd08DZ5M7sL/M78qhwq2kvp8YOJUHz8lM:Iyxrqh2Hr8mWqBvoD/M+0elvYAsJr

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2972	1292	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1292	2040	rundll32.exe	28
PID 2040 wrote to memory of 1292	2040	rundll32.exe	28
PID 2040 wrote to memory of 1292	2040	rundll32.exe	28
PID 2040 wrote to memory of 1292	2040	rundll32.exe	28
PID 2040 wrote to memory of 1292	2040	rundll32.exe	28
PID 2040 wrote to memory of 1292	2040	rundll32.exe	28
PID 2040 wrote to memory of 1292	2040	rundll32.exe	28
PID 1292 wrote to memory of 2972	1292	rundll32.exe	29
PID 1292 wrote to memory of 2972	1292	rundll32.exe	29
PID 1292 wrote to memory of 2972	1292	rundll32.exe	29
PID 1292 wrote to memory of 2972	1292	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae7e7b9c652bf97f2279b4456dd66686c1cfc4493bdafba261c0d6809c920074.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae7e7b9c652bf97f2279b4456dd66686c1cfc4493bdafba261c0d6809c920074.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1292
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1292 -s 224
    3⤵
    - Program crash
    PID:2972

memory/1292-0-0x0000000074F60000-0x0000000074F71000-memory.dmp

Filesize
68KB

Download