9f3e7982d544a6fc74582081e2d46b8464d10a0cbf282ecfaa7d86f31891d938

Analysis

max time kernel
177s
max time network
218s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 13:37

Target

9f3e7982d544a6fc74582081e2d46b8464d10a0cbf282ecfaa7d86f31891d938.dll
Size

65KB
MD5

6b2bd82bca12c3a61a7a1a991891d100
SHA1

4faee0d1fbcd4d6fec21d8433ac6a47668641820
SHA256

9f3e7982d544a6fc74582081e2d46b8464d10a0cbf282ecfaa7d86f31891d938
SHA512

d420e286b4a4ed0b37e2e13484fcefad731406bba21fbcdaae8642019d0805e5177fde6bb555d4a291a5a2a56b9c4fe0f98c0cf2091ad0ad805458d0659990ab
SSDEEP

768:4sQBTinxkpd9phmfB20RTviDxS2GBg9fMcuqmyI+UWxJha5:45BTScd9zNDADBgnuqmL5m

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1712	1436	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3340 wrote to memory of 1436	3340	rundll32.exe	81
PID 3340 wrote to memory of 1436	3340	rundll32.exe	81
PID 3340 wrote to memory of 1436	3340	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f3e7982d544a6fc74582081e2d46b8464d10a0cbf282ecfaa7d86f31891d938.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f3e7982d544a6fc74582081e2d46b8464d10a0cbf282ecfaa7d86f31891d938.dll,#1
  2⤵
  PID:1436
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 556
    3⤵
    - Program crash
    PID:1712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1436 -ip 1436
1⤵
PID:484