bd5c4675cd3864147cfe677765a6f949b5b2ab2b70ef73525af994393dc6f0e7

Analysis

max time kernel
164s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 15:16

Target

bd5c4675cd3864147cfe677765a6f949b5b2ab2b70ef73525af994393dc6f0e7.dll
Size

102KB
MD5

0a9267abf7f75b732cb5bb7f0f612fe6
SHA1

28fccfdb1f2b92e627fc875f1c7d04359c1bc011
SHA256

bd5c4675cd3864147cfe677765a6f949b5b2ab2b70ef73525af994393dc6f0e7
SHA512

ee0cb01eadc7419d5a26a5a13ccaedc8d0c565b9f6b9a14208858a60d62b67f9aafd977e68b8a8416145bb4aba77c7311accd5dd68dc3403de2b38a71afda783
SSDEEP

1536:6Msa6kRfJirY84erfImafc61JfcUcKDRA8/HUtpFXCAIu:6Va6wiraf91JcUcw/HUtpFXCAIu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4844	2652	WerFault.exe	59

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 2652	2140	rundll32.exe	59
PID 2140 wrote to memory of 2652	2140	rundll32.exe	59
PID 2140 wrote to memory of 2652	2140	rundll32.exe	59

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd5c4675cd3864147cfe677765a6f949b5b2ab2b70ef73525af994393dc6f0e7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd5c4675cd3864147cfe677765a6f949b5b2ab2b70ef73525af994393dc6f0e7.dll,#1
  2⤵
  PID:2652
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 660
    3⤵
    - Program crash
    PID:4844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2652 -ip 2652
1⤵
PID:480