85c7975c0755b242ab0de2c68bad51a8f6cb0eb9f3ea2b2bdce9168d48043a06

Analysis

Target

85c7975c0755b242ab0de2c68bad51a8f6cb0eb9f3ea2b2bdce9168d48043a06.dll
Size

199KB
MD5

9a0cd65ba55d5446b2c83fb8b608ddce
SHA1

854eaee1a1c94cb13960ce99b43ac16e1fc6f06f
SHA256

85c7975c0755b242ab0de2c68bad51a8f6cb0eb9f3ea2b2bdce9168d48043a06
SHA512

4ef0f9255aaa5537f17f7ec2f6eb23714347baa90158637534077054e3144089936c0cf85f0f8b45ae28782c23e6b4dbf656afb13bf24aff092c45cace46a8fb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4368	1804	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3148 wrote to memory of 1804	3148	rundll32.exe	79
PID 3148 wrote to memory of 1804	3148	rundll32.exe	79
PID 3148 wrote to memory of 1804	3148	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\85c7975c0755b242ab0de2c68bad51a8f6cb0eb9f3ea2b2bdce9168d48043a06.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3148
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\85c7975c0755b242ab0de2c68bad51a8f6cb0eb9f3ea2b2bdce9168d48043a06.dll,#1
  2⤵
  PID:1804
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 600
    3⤵
    - Program crash
    PID:4368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1804 -ip 1804
1⤵
PID:2084