a5a291a48263f8240c9fe0a59eee972193cc70a701d7895f5d5f99c3681f6361

Analysis

max time kernel
152s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 09:27

Target

a5a291a48263f8240c9fe0a59eee972193cc70a701d7895f5d5f99c3681f6361.dll
Size

92KB
MD5

65ba33dd403405711a436cbdb09340dd
SHA1

25a7d468c5cd70dfed6a0da8c4058e608d01c852
SHA256

a5a291a48263f8240c9fe0a59eee972193cc70a701d7895f5d5f99c3681f6361
SHA512

4a701084d1c220594812cfdfbe8bdccf6b3f92692f2c5299e43d6b04559f1465b41e6c609c247701378782c393d60dfd74d84c38c75d7c517277aa6e326c1bd5
SSDEEP

1536:+ID7mEVe+fsZr0ItmnKXH99P5ju7/a9Z9OFS:JD6+C0IkKTPFuDa9ZI4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1004	4444	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 4444	1436	rundll32.exe	81
PID 1436 wrote to memory of 4444	1436	rundll32.exe	81
PID 1436 wrote to memory of 4444	1436	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a5a291a48263f8240c9fe0a59eee972193cc70a701d7895f5d5f99c3681f6361.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a5a291a48263f8240c9fe0a59eee972193cc70a701d7895f5d5f99c3681f6361.dll,#1
  2⤵
  PID:4444
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 668
    3⤵
    - Program crash
    PID:1004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4444 -ip 4444
1⤵
PID:3304