7d8c97edab987298a3f41e7c0271f246b103c24ca480b944729c7a059ee9dc8c

Analysis

max time kernel
176s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 11:20

Target

7d8c97edab987298a3f41e7c0271f246b103c24ca480b944729c7a059ee9dc8c.dll
Size

48KB
MD5

23a9fd5d746cfd0a55a07cae3f536d38
SHA1

bce38830ed6cd09258a4b534bdd0bf1b21a38b78
SHA256

7d8c97edab987298a3f41e7c0271f246b103c24ca480b944729c7a059ee9dc8c
SHA512

dcca4f0f74d1f6ff26d95a4f519fccf2dfa41f2c0d7f91a1c9777a681384b2f31f3a77785f49d1049a88ed43da6c6c4b3f59978f877b6fce2bc961ec56beb553
SSDEEP

384:yFvKjz8TpaKE1AaSiUiB37kJuxRecNjybudauTuSq+cA/8opOCCD:xQTpaKeYiB3F3jPdauTr/8opO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4824	3600	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 3600	992	rundll32.exe	80
PID 992 wrote to memory of 3600	992	rundll32.exe	80
PID 992 wrote to memory of 3600	992	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7d8c97edab987298a3f41e7c0271f246b103c24ca480b944729c7a059ee9dc8c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7d8c97edab987298a3f41e7c0271f246b103c24ca480b944729c7a059ee9dc8c.dll,#1
  2⤵
  PID:3600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3600 -s 616
    3⤵
    - Program crash
    PID:4824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3600 -ip 3600
1⤵
PID:4496