a4cf533b52088db1a819c5ea622d42f809d9152324874740ee8cc34fda6032f5

Analysis

max time kernel
93s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2022 12:40

Target

a4cf533b52088db1a819c5ea622d42f809d9152324874740ee8cc34fda6032f5.dll
Size

434KB
MD5

704b01f1de1ea6459e32a9c4f61f2afc
SHA1

8d2fbfcbf5560101f6e79ec99a69298fc6bd4a95
SHA256

a4cf533b52088db1a819c5ea622d42f809d9152324874740ee8cc34fda6032f5
SHA512

52247b812398b2f0b3f85574c665947505e6370b6f25174da6c8aeced608726d61d58bb9e91f127542b0ecd127501d11e2b6780769a29e66198c9788063bdbdd
SSDEEP

6144:utijaTxc2HetY24OJkX+X0IHsjBdgLHd6oOpJhnPmrgrgHVaGteKtCVGuePeo:ut3Te2k4OmX21Hd6FpbYomabKdPT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4448	4884	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 4884	4948	rundll32.exe	82
PID 4948 wrote to memory of 4884	4948	rundll32.exe	82
PID 4948 wrote to memory of 4884	4948	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a4cf533b52088db1a819c5ea622d42f809d9152324874740ee8cc34fda6032f5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a4cf533b52088db1a819c5ea622d42f809d9152324874740ee8cc34fda6032f5.dll,#1
  2⤵
  PID:4884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 596
    3⤵
    - Program crash
    PID:4448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4884 -ip 4884
1⤵
PID:960