e1b3ae8fc890c6588e5656f77ef2747ae7ddfc90b6530b240c0c5b9d0ab3ce8c

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 14:15

Target

dxupdate.dll
Size

173KB
MD5

7ed554b08e5b69578f9de012822c39c9
SHA1

036d04513e134786b4758def5aff83d19bf50c6e
SHA256

fb4f297e295c802b1377c6684734b7249d55743dfb7c14807bef59a1b5db63a2
SHA512

7af5f9c4a3ad5c120bcdd681b958808ada4d885d21aeb4a009a36a674ad3ece9b51837212a982db6142a6b5580e5b68d46971b802456701391ce40785ae6ebd9
SSDEEP

3072:KU6LKKnw8i/9S7BLGKm/nuFV3uNgosUBxr+2y97CqGIpHtWMeJnQRLj+bTHyKaY:Iw8aIMrfuFVeNgosUBxra4rIZsqq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2884	2660	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2660	2340	rundll32.exe	28
PID 2340 wrote to memory of 2660	2340	rundll32.exe	28
PID 2340 wrote to memory of 2660	2340	rundll32.exe	28
PID 2340 wrote to memory of 2660	2340	rundll32.exe	28
PID 2340 wrote to memory of 2660	2340	rundll32.exe	28
PID 2340 wrote to memory of 2660	2340	rundll32.exe	28
PID 2340 wrote to memory of 2660	2340	rundll32.exe	28
PID 2660 wrote to memory of 2884	2660	rundll32.exe	29
PID 2660 wrote to memory of 2884	2660	rundll32.exe	29
PID 2660 wrote to memory of 2884	2660	rundll32.exe	29
PID 2660 wrote to memory of 2884	2660	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dxupdate.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dxupdate.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 228
    3⤵
    - Program crash
    PID:2884