6fa5054b762b2e2b15b27e5a01e81a92d8f9af41216f1e2d35d797903289e215

Analysis

Target

6fa5054b762b2e2b15b27e5a01e81a92d8f9af41216f1e2d35d797903289e215.dll
Size

1.3MB
MD5

9ffac7533cb82db816f39c5595201658
SHA1

148f35a1fdf7d62401910f25123ee50f4d534bdb
SHA256

6fa5054b762b2e2b15b27e5a01e81a92d8f9af41216f1e2d35d797903289e215
SHA512

c72cba78fff45360335269681f13a2569d084f766e378d25cc6ce713504ecc62a6b3a3f1362b636f2d600db2df900ff853c5a9efdc8d72200842662199ed58a8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1700	2316	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 2316	1560	rundll32.exe	81
PID 1560 wrote to memory of 2316	1560	rundll32.exe	81
PID 1560 wrote to memory of 2316	1560	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6fa5054b762b2e2b15b27e5a01e81a92d8f9af41216f1e2d35d797903289e215.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6fa5054b762b2e2b15b27e5a01e81a92d8f9af41216f1e2d35d797903289e215.dll,#1
  2⤵
  PID:2316
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 716
    3⤵
    - Program crash
    PID:1700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2316 -ip 2316
1⤵
PID:3404