3892721b8068aff9080965fe5eedf30dd488ef5d08c12234af66a2ca97bfe476

Analysis

max time kernel
151s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 13:30

Target

3892721b8068aff9080965fe5eedf30dd488ef5d08c12234af66a2ca97bfe476.dll
Size

524KB
MD5

3df37859f46be01b08e6e7dd3060f6d2
SHA1

5594b9d6d30d705a3a05f9e0d5eb11f6b34b7b5d
SHA256

3892721b8068aff9080965fe5eedf30dd488ef5d08c12234af66a2ca97bfe476
SHA512

492c503744413ab7ef6a2570b316ed36a53aa1a121fb8622fe4574fe611c91788e3d0435fc9013cc40d455d84c6eab940668a68e819debaee785cae53dd2d7c4
SSDEEP

12288:OVr0/yDvpHL3ks7oNZE7KHWfRS+nsKPLOCh+H1:OrLpbd0ANSYaCoH1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1384	2032	WerFault.exe	72

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 2032	2640	rundll32.exe	72
PID 2640 wrote to memory of 2032	2640	rundll32.exe	72
PID 2640 wrote to memory of 2032	2640	rundll32.exe	72

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3892721b8068aff9080965fe5eedf30dd488ef5d08c12234af66a2ca97bfe476.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3892721b8068aff9080965fe5eedf30dd488ef5d08c12234af66a2ca97bfe476.dll,#1
  2⤵
  PID:2032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 564
    3⤵
    - Program crash
    PID:1384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2032 -ip 2032
1⤵
PID:3392