7a7c2275609cce5171cbade81e873d366a3390c0ef464a4feef0153de7f28feb

Analysis

max time kernel
88s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2022 00:06

Target

7a7c2275609cce5171cbade81e873d366a3390c0ef464a4feef0153de7f28feb.dll
Size

268KB
MD5

3272c4ddffd078a8943a533c88eb96ba
SHA1

b982dc7bf9eb9a46456d00b58d798ae84acb0d34
SHA256

7a7c2275609cce5171cbade81e873d366a3390c0ef464a4feef0153de7f28feb
SHA512

bbbb93da8760a668958943bf4a5f0f63d099444877b9982a7aff307f411241e4dbb56679dd0efcaad6f293d4a4a26b46cbdb69ee59dd377f920fd9f92abe8ca3
SSDEEP

6144:+HTbAIUDK+wRP2hy6t2hO8I4iglaSpiMZx7Z:+HWDK/Rehy6BjA/D7Z

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2416	5004	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 5004	1300	rundll32.exe	84
PID 1300 wrote to memory of 5004	1300	rundll32.exe	84
PID 1300 wrote to memory of 5004	1300	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a7c2275609cce5171cbade81e873d366a3390c0ef464a4feef0153de7f28feb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a7c2275609cce5171cbade81e873d366a3390c0ef464a4feef0153de7f28feb.dll,#1
  2⤵
  PID:5004
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 564
    3⤵
    - Program crash
    PID:2416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5004 -ip 5004
1⤵
PID:4316