e13f7019f8f66e379c29b0854bf93bd7f3f33fa02e890879094c1ee5213b7760

Analysis

max time kernel
86s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2022, 15:47

Target
78458186578e35ac9b8539053d144d47.dll
Size 2.7MB
Sample220929-s77k6abcg3
SHA256 e13f7019f8f66e379c29b0854bf93bd7f3f33fa02e890879094c1ee5213b7760
MD5 78458186578e35ac9b8539053d144d47
SHA1 4110152901a842e4e53f10647b91fe8d77c169c7
SHA512 cb16a166653d26b7294b8d5c67962b014dab9c0e89a7a9fe3605095e8de47296778f31f00cba6608cf7a8436b43661246049ee80a086bb9fe593df710e3d5548
SSDEEP 49152:Jzl1rpbUrqvv0v2rQVt8nqwI7lOOYcC2ek:P1Kqvv07noI7lOOYcG
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2648	5092	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 5092	4984	rundll32.exe	82
PID 4984 wrote to memory of 5092	4984	rundll32.exe	82
PID 4984 wrote to memory of 5092	4984	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\78458186578e35ac9b8539053d144d47.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\78458186578e35ac9b8539053d144d47.dll,#1
  2⤵
  PID:5092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 552
    3⤵
    - Program crash
    PID:2648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 5092 -ip 5092
1⤵
PID:1540