7ac8bea34812309e4410ba92d6ac0a0bbbda894dde4fe8523d156bca52e5fa7b

Analysis

max time kernel
90s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18/09/2022, 22:57

Target

7ac8bea34812309e4410ba92d6ac0a0bbbda894dde4fe8523d156bca52e5fa7b.dll
Size

2.7MB
MD5

8472089e203598eaf4dbc4e702a5a5ee
SHA1

dcf9a6e8142843837f212c57077799e761ea14ea
SHA256

7ac8bea34812309e4410ba92d6ac0a0bbbda894dde4fe8523d156bca52e5fa7b
SHA512

52307114b3f57547389571be2ab23d3316391329326bb8512b90e148df2c9ad9c5669eef01b6af5420efc669c42fbcbd9d190d9ed19b6bf82a784a4447ef1fc0
SSDEEP

49152:yFxROxRWxRvxR+xR9xR4xRwxRjxR2xRLxRcxRAxRBxR7xROxRKxRUxRFxRoxR:sGeb2lsUf+3wkpnGC49c

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2640	1484	WerFault.exe	76

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 1484	4528	rundll32.exe	76
PID 4528 wrote to memory of 1484	4528	rundll32.exe	76
PID 4528 wrote to memory of 1484	4528	rundll32.exe	76

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ac8bea34812309e4410ba92d6ac0a0bbbda894dde4fe8523d156bca52e5fa7b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ac8bea34812309e4410ba92d6ac0a0bbbda894dde4fe8523d156bca52e5fa7b.dll,#1
  2⤵
  PID:1484
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 616
    3⤵
    - Program crash
    PID:2640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1484 -ip 1484
1⤵
PID:1848