14b16ea8b6113efa15ab6a8fc9e9bbfa5613a3eef5d894309290a3b2f2689ab9

Analysis

max time kernel
152s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 09:27

Target

14b16ea8b6113efa15ab6a8fc9e9bbfa5613a3eef5d894309290a3b2f2689ab9.dll
Size

90KB
MD5

6e1022b00cf9968ce532eb35a90e4d9c
SHA1

62f7aef54a7c6a949ea47d254699a7ad559a99d2
SHA256

14b16ea8b6113efa15ab6a8fc9e9bbfa5613a3eef5d894309290a3b2f2689ab9
SHA512

6609ed47adbc805bb4722562a24437c3738ef6c6b38e5f19dfc02346cfab335e730a263157c69cb04acd0052bf316f26de4430d8ef1a5eafdf80c700e05ae592
SSDEEP

1536:nylNPfcD+KZzd2vXmIzk9aoSfy2IdDKLHF4NCjUNk6xpx8jBrW8T4HlE98V:INPfvCzkvXnWifcROyKUNJxpxGS8TMlb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
728	1188	WerFault.exe	76

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 1188	4624	rundll32.exe	76
PID 4624 wrote to memory of 1188	4624	rundll32.exe	76
PID 4624 wrote to memory of 1188	4624	rundll32.exe	76

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\14b16ea8b6113efa15ab6a8fc9e9bbfa5613a3eef5d894309290a3b2f2689ab9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\14b16ea8b6113efa15ab6a8fc9e9bbfa5613a3eef5d894309290a3b2f2689ab9.dll,#1
  2⤵
  PID:1188
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 544
    3⤵
    - Program crash
    PID:728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1188 -ip 1188
1⤵
PID:3064