c489a2b966c615504a618c46ab8dbbe94d5f11cec2219113c2d0b62e4bb497d2

Analysis

Target

c489a2b966c615504a618c46ab8dbbe94d5f11cec2219113c2d0b62e4bb497d2.dll
Size

305KB
MD5

a3c8febccc2edd615ff98e78b8ebf6c2
SHA1

071f15d61322c0480bb71690ed114f3736f7844c
SHA256

c489a2b966c615504a618c46ab8dbbe94d5f11cec2219113c2d0b62e4bb497d2
SHA512

6c15e95112868969184d511f5cc35bddd868e8e2a4c61b4c12bff45383e62a0a90fe1fde4bd56fa0dca1523ebf90c05e8a5e08966d3b6f85517156fd5d38d28b

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
980	4016	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 4016	3288	rundll32.exe	80
PID 3288 wrote to memory of 4016	3288	rundll32.exe	80
PID 3288 wrote to memory of 4016	3288	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c489a2b966c615504a618c46ab8dbbe94d5f11cec2219113c2d0b62e4bb497d2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c489a2b966c615504a618c46ab8dbbe94d5f11cec2219113c2d0b62e4bb497d2.dll,#1
  2⤵
  PID:4016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 632
    3⤵
    - Program crash
    PID:980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4016 -ip 4016
1⤵
PID:1220