c9d438fa530f60211a816098d6f3646863264e942ea177af256e4869a4644752

Analysis

max time kernel
144s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 09:45

Target

c9d438fa530f60211a816098d6f3646863264e942ea177af256e4869a4644752.dll
Size

28KB
MD5

6e5479da504017e57be1cbc11c21e047
SHA1

86d460b9c17c9c18fde99e4e17dc1491e2414ca0
SHA256

c9d438fa530f60211a816098d6f3646863264e942ea177af256e4869a4644752
SHA512

03f68795b480c006e48c31ff85501f673281dda30c32b985db5ce7835ad92c4d27129391ab875b2fe67ef286dd0e5d27667232c8ba2cd2fe447a85df1e402271
SSDEEP

768:F+NRnM5hLjxNKqXaMCwG68Zwuf4kP0dmu7z:F95ZjCqqaG5f4kYmO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1260	524	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 524	844	rundll32.exe	85
PID 844 wrote to memory of 524	844	rundll32.exe	85
PID 844 wrote to memory of 524	844	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c9d438fa530f60211a816098d6f3646863264e942ea177af256e4869a4644752.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c9d438fa530f60211a816098d6f3646863264e942ea177af256e4869a4644752.dll,#1
  2⤵
  PID:524
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 548
    3⤵
    - Program crash
    PID:1260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 524 -ip 524
1⤵
PID:2880