923793b5ebd17ef82d44d152c1f34b0010f366a8ee84a41d86dd7ad4ecf6e153

Analysis

max time kernel
91s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27-09-2022 06:49

Target

wow64_microsoft-windows-msvcp110_31bf3856ad364e35_10.0.22621.1_none_59a0c10b9934ff9d_msvcp110_win.dll
Size

408KB
MD5

f91e3f8ef242c9f0bdf837d07aab797f
SHA1

5069aad45e2c2ad88bfe6c455a2b9969660183c3
SHA256

6ed71a6689f3ce0de57fa3b2179767264917f3329d462e5c9f78816a3f331664
SHA512

d36e0578ffe6619bcc781965bc3077d15aa49ee9cf9edfd4487022ddf4578db2ba722920993120f2477609c1a6a7bb71b8f875e83e0f8b0fe92891489c1bb645
SSDEEP

12288:qWUDzopINU2lFnQ9I3HijHhUgiW6QR7t5sa3Ooc8fHkC2e/Hq8T:qW5pINU2lFnWI3HiIa3Ooc8fHkC2e/HP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3588	4728	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 4728	4828	rundll32.exe	80
PID 4828 wrote to memory of 4728	4828	rundll32.exe	80
PID 4828 wrote to memory of 4728	4828	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\wow64_microsoft-windows-msvcp110_31bf3856ad364e35_10.0.22621.1_none_59a0c10b9934ff9d_msvcp110_win.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\wow64_microsoft-windows-msvcp110_31bf3856ad364e35_10.0.22621.1_none_59a0c10b9934ff9d_msvcp110_win.dll,#1
  2⤵
  PID:4728
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 600
    3⤵
    - Program crash
    PID:3588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4728 -ip 4728
1⤵
PID:2256