ca2b787bb72f0bd9d79013aa93800bfd84c73aad74662c48e69425e4adfb549b

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 06:44

Target
iepdf32.dll
Size 4.3MB
Sample240612-hhtmwstblj
SHA256 4ba2ddde8a4549d08bfe4441643aa626e84d7653b8ddc6ed61823e78aeb3cdf1
MD5 f3f6876d132eb277842e31ddc42aa7fa
SHA1 9c167a2854ed106b74dff55a30bdefc55b140e9a
SHA512 38b86c745945b0f97461542f89b2570210ddc3fcfeabfe2243a3b861dd80be6641e4b4181956d73926b7926d7c460db8a908ccb912c5209003ee24427aa135f9
SSDEEP 98304:lszKnK7RZKZk8AZ1uWhgTsOTbUW5gmTKuCIUePaFownQCICDQ9:dRZkB1WPgmXPa+CICDA
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2592	2036	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2036	2176	rundll32.exe	28
PID 2176 wrote to memory of 2036	2176	rundll32.exe	28
PID 2176 wrote to memory of 2036	2176	rundll32.exe	28
PID 2176 wrote to memory of 2036	2176	rundll32.exe	28
PID 2176 wrote to memory of 2036	2176	rundll32.exe	28
PID 2176 wrote to memory of 2036	2176	rundll32.exe	28
PID 2176 wrote to memory of 2036	2176	rundll32.exe	28
PID 2036 wrote to memory of 2592	2036	rundll32.exe	29
PID 2036 wrote to memory of 2592	2036	rundll32.exe	29
PID 2036 wrote to memory of 2592	2036	rundll32.exe	29
PID 2036 wrote to memory of 2592	2036	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\iepdf32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\iepdf32.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 220
    3⤵
    - Program crash
    PID:2592