fff332b73e9cc97c4c365dc511441f7041a544b3d7d062f0894f65cbc3e47581

Analysis

max time kernel
139s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 06:11

Target

fff332b73e9cc97c4c365dc511441f7041a544b3d7d062f0894f65cbc3e47581.dll
Size

246KB
MD5

7bfb9809a96d29b9d3f1692bd4623c29
SHA1

b8314f5dbec7d97546485a0f99e85ed9d0c80485
SHA256

fff332b73e9cc97c4c365dc511441f7041a544b3d7d062f0894f65cbc3e47581
SHA512

bdf164598d12401a1e7258702d907a0db2f8d3f9f6644244d584c4a05dd4e86c76c9a91b8c17cac61182aa7b7a16043d1e97ff1b04c982749fa1ac386d06b06f
SSDEEP

6144:T0k3G8hIXmkFCi2uXur+GAAlJafmmpmvOj:T0AfGF1XNAl0HpmW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4140	1660	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 1660	4796	rundll32.exe	82
PID 4796 wrote to memory of 1660	4796	rundll32.exe	82
PID 4796 wrote to memory of 1660	4796	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fff332b73e9cc97c4c365dc511441f7041a544b3d7d062f0894f65cbc3e47581.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fff332b73e9cc97c4c365dc511441f7041a544b3d7d062f0894f65cbc3e47581.dll,#1
  2⤵
  PID:1660
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 580
    3⤵
    - Program crash
    PID:4140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1660 -ip 1660
1⤵
PID:2264