76063a54ec28f071c72d73dfed45353348667dedd155848a4f5d7018c4f4c9a2

Analysis

max time kernel
147s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 14:19

Target

76063a54ec28f071c72d73dfed45353348667dedd155848a4f5d7018c4f4c9a2.dll
Size

205KB
MD5

6aa182124f62672c2bb39d092335ddc0
SHA1

2a4fc40f1c1d6837114e2734b4c2f00128c45f77
SHA256

76063a54ec28f071c72d73dfed45353348667dedd155848a4f5d7018c4f4c9a2
SHA512

558e9aaccabc8a80e74bfa805d4f2257f1c80fe6bc1f2a680677f3bec2a32a579283204577081137add6aa7edc8fc9257d66beaffe9d82c72c80b19b572d9725
SSDEEP

3072:narvEqiwAX2x75rmhS75cAqStJ9QgxzgMdlqScP3pAofK1FmO:nq8qiFGtUsuANagtgEPIAoS1Fr

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2904	4068	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 4068	1124	rundll32.exe	81
PID 1124 wrote to memory of 4068	1124	rundll32.exe	81
PID 1124 wrote to memory of 4068	1124	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\76063a54ec28f071c72d73dfed45353348667dedd155848a4f5d7018c4f4c9a2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\76063a54ec28f071c72d73dfed45353348667dedd155848a4f5d7018c4f4c9a2.dll,#1
  2⤵
  PID:4068
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 616
    3⤵
    - Program crash
    PID:2904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4068 -ip 4068
1⤵
PID:4760