b3fd0e697434b0d74adbae84edd1eb7bb4c5e81fcd39948f7189db50ae730295

Analysis

max time kernel
152s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 21:37

Target

worker_10101_b3fd0e697434b0d74adbae84edd1eb7bb4c5e81fcd39948f7189db50ae730295.dll
Size

177KB
MD5

f0321c409734231d4eaedf8bb0cd8a85
SHA1

060ebe1a8eeb459f137d97d92bb3a307e69db1c0
SHA256

b3fd0e697434b0d74adbae84edd1eb7bb4c5e81fcd39948f7189db50ae730295
SHA512

1549b8d658811f7efc2c72f2caa51dc28f972df3634ad007431b20adb0a21ee22a633863adc0a9807670b4ca78df28b376d403252c6690d175967c1783c29c1f
SSDEEP

3072:ZLQsLhnCYPu9BTqN+SxXZHz1/HfGBg2WbnV/Hm+CfbG5aX9S2CkcD2ff+4Bo:ekuX0tH9GLWbnVTCDG6Skc0+oo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4752	1404	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 1404	4140	rundll32.exe	82
PID 4140 wrote to memory of 1404	4140	rundll32.exe	82
PID 4140 wrote to memory of 1404	4140	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\worker_10101_b3fd0e697434b0d74adbae84edd1eb7bb4c5e81fcd39948f7189db50ae730295.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\worker_10101_b3fd0e697434b0d74adbae84edd1eb7bb4c5e81fcd39948f7189db50ae730295.dll,#1
  2⤵
  PID:1404
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 696
    3⤵
    - Program crash
    PID:4752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1404 -ip 1404
1⤵
PID:1656