c4932fad51772988c4b4f8e305a0be755eebeb34124d124c8d728a8ea867b179

Analysis

max time kernel
137s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2022 21:11

Target

c4932fad51772988c4b4f8e305a0be755eebeb34124d124c8d728a8ea867b179.dll
Size

157KB
MD5

7b5813655ad1925cdc50f2197750a594
SHA1

162031e0f21739ce774db7ec92ba9a7e4d0f734b
SHA256

c4932fad51772988c4b4f8e305a0be755eebeb34124d124c8d728a8ea867b179
SHA512

9c678ffbcd18c4c23e5d6262e0f44ffbe0a1a2456009ed5a132b6229d3c936e878a1e6a339c89dc10ffd93054a6065cc16721fd6fba58940b5f6d6ae642b7c85
SSDEEP

3072:8WEAy+sRED0/8YysdOJPFuDa9ZroNncdaw:8WEF+sKD0EYy+M9u2ZL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1660	1224	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 1224	4776	rundll32.exe	82
PID 4776 wrote to memory of 1224	4776	rundll32.exe	82
PID 4776 wrote to memory of 1224	4776	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c4932fad51772988c4b4f8e305a0be755eebeb34124d124c8d728a8ea867b179.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c4932fad51772988c4b4f8e305a0be755eebeb34124d124c8d728a8ea867b179.dll,#1
  2⤵
  PID:1224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1224 -s 692
    3⤵
    - Program crash
    PID:1660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1224 -ip 1224
1⤵
PID:4120