e070f61560ec60580eb1f1b20128f22b8052f3faf8dc6f75e656f8b9a8876293

Analysis

max time kernel
16s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 05:05

Target

6455083093ea1d0f23826208bad12af0N.dll
Size

48KB
MD5

6455083093ea1d0f23826208bad12af0
SHA1

4e0e9fc6dead2cb83d61162bc5335e558a2ffeea
SHA256

e070f61560ec60580eb1f1b20128f22b8052f3faf8dc6f75e656f8b9a8876293
SHA512

593214b4f1653c2be5dd859b6d05a96abe5b162b9d739885ea86d23aadcd3cf3b77972792ac78f7a4c3fa6d1162d663bdacde1ec616973ad0d9392df6eb92869
SSDEEP

768:S3njn3FlxxCWfgi1HMr6LpJhDLSk3/M+b92cBYDx+:Injn3NxnXHtLpJhDLX3/fs9D

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2388	1240	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 1240	2200	rundll32.exe	28
PID 2200 wrote to memory of 1240	2200	rundll32.exe	28
PID 2200 wrote to memory of 1240	2200	rundll32.exe	28
PID 2200 wrote to memory of 1240	2200	rundll32.exe	28
PID 2200 wrote to memory of 1240	2200	rundll32.exe	28
PID 2200 wrote to memory of 1240	2200	rundll32.exe	28
PID 2200 wrote to memory of 1240	2200	rundll32.exe	28
PID 1240 wrote to memory of 2388	1240	rundll32.exe	31
PID 1240 wrote to memory of 2388	1240	rundll32.exe	31
PID 1240 wrote to memory of 2388	1240	rundll32.exe	31
PID 1240 wrote to memory of 2388	1240	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6455083093ea1d0f23826208bad12af0N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6455083093ea1d0f23826208bad12af0N.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1240
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 260
    3⤵
    - Program crash
    PID:2388