6fa5054b762b2e2b15b27e5a01e81a92d8f9af41216f1e2d35d797903289e215

Analysis

Target
6fa5054b762b2e2b15b27e5a01e81a92d8f9af41216f1e2d35d797903289e215.dll
Size 1.3MB
Sample220511-3sea6sddf3
SHA256 6fa5054b762b2e2b15b27e5a01e81a92d8f9af41216f1e2d35d797903289e215
MD5 9ffac7533cb82db816f39c5595201658
SHA1 148f35a1fdf7d62401910f25123ee50f4d534bdb
SHA512 c72cba78fff45360335269681f13a2569d084f766e378d25cc6ce713504ecc62a6b3a3f1362b636f2d600db2df900ff853c5a9efdc8d72200842662199ed58a8
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1700	2316	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 2316	1560	rundll32.exe	81
PID 1560 wrote to memory of 2316	1560	rundll32.exe	81
PID 1560 wrote to memory of 2316	1560	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6fa5054b762b2e2b15b27e5a01e81a92d8f9af41216f1e2d35d797903289e215.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6fa5054b762b2e2b15b27e5a01e81a92d8f9af41216f1e2d35d797903289e215.dll,#1
  2⤵
  PID:2316
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 716
    3⤵
    - Program crash
    PID:1700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2316 -ip 2316
1⤵
PID:3404