8d723efb22166f906a3d48f9d2ce099c536afc56c8ca3e22789abb8a8de0a98a

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 02:21

Target
8d723efb22166f906a3d48f9d2ce099c536afc56c8ca3e22789abb8a8de0a98a.dll
Size 603KB
Sample221011-ctf82sage6
SHA256 8d723efb22166f906a3d48f9d2ce099c536afc56c8ca3e22789abb8a8de0a98a
MD5 64b0e6140754b8d07d47f84df5bc18c7
SHA1 a0d21188917ec2dae942891dc41199f85959bc09
SHA512 2be1c3ecc7be635c051b66441e95a4189f54d99d5435b9d8102facd0c08610bcc5de61052b69a6bcae91da097905c8a1beb67d3a9facd9a01c04559ee422c85f
SSDEEP 6144:Ob2HnveeTMmk+5Ky1O1/3baIJ+Qh0OXx53qX:GknsF+511O1/baIJ+Qh/
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3900	3496	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 3496	1484	rundll32.exe	82
PID 1484 wrote to memory of 3496	1484	rundll32.exe	82
PID 1484 wrote to memory of 3496	1484	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8d723efb22166f906a3d48f9d2ce099c536afc56c8ca3e22789abb8a8de0a98a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8d723efb22166f906a3d48f9d2ce099c536afc56c8ca3e22789abb8a8de0a98a.dll,#1
  2⤵
  PID:3496
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 544
    3⤵
    - Program crash
    PID:3900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3496 -ip 3496
1⤵
PID:528