bc4101cb2be2bc8fedb16c82b4c4dc808176f519f9c2c8012c6e18b4b35d932d

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/06/2024, 07:54

Target

ExtensionManager.dll
Size

121KB
MD5

b1d3e1679bd267facd40604edcde2f5b
SHA1

08c1ad07bb1e5133a7489fe9a777dd1d1d980bfc
SHA256

361fd06e5c3acabb49e21906f83579d5fab59266210b365909fba1f478e8f6b8
SHA512

2c684d29e35b28e91cd1816179e95f08cb931049a76182a7d45561c23a3f0b4dd7f7398c142f7db6dcb82452432544c21ec6749d72f2e011504563795c187f0b
SSDEEP

1536:2GjKcE8Nbu2NtzibjUzcez/EC6PWSd2g3Il+0+Yvpc96YsWjcd9FdPDQJyOI:zK+rpj/WlFSV+6Q6H9FdPDQJyOI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2832	2816	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2816	2224	rundll32.exe	28
PID 2224 wrote to memory of 2816	2224	rundll32.exe	28
PID 2224 wrote to memory of 2816	2224	rundll32.exe	28
PID 2224 wrote to memory of 2816	2224	rundll32.exe	28
PID 2224 wrote to memory of 2816	2224	rundll32.exe	28
PID 2224 wrote to memory of 2816	2224	rundll32.exe	28
PID 2224 wrote to memory of 2816	2224	rundll32.exe	28
PID 2816 wrote to memory of 2832	2816	rundll32.exe	29
PID 2816 wrote to memory of 2832	2816	rundll32.exe	29
PID 2816 wrote to memory of 2832	2816	rundll32.exe	29
PID 2816 wrote to memory of 2832	2816	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExtensionManager.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExtensionManager.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 220
    3⤵
    - Program crash
    PID:2832