eff8e5129f5803851154f74b8dfb271d237d1a768b84687018b9b87e36425b66

Analysis

max time kernel
182s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2022 14:39

Target

eff8e5129f5803851154f74b8dfb271d237d1a768b84687018b9b87e36425b66.dll
Size

20KB
MD5

6ec375367a8db8be4c5c5154c805d7a8
SHA1

a1530304f8980909d66bd2f2dc1a0c5af6e17b4d
SHA256

eff8e5129f5803851154f74b8dfb271d237d1a768b84687018b9b87e36425b66
SHA512

bd9b9dd3ebb5c7bcb18c22ac411310547ce7e494060583a334524e5057c9164ea94b41969ce74356e9990bf1f82c551f9b522a65bf03235e938d2e4a10c2902d
SSDEEP

384:zSG/2Jp+C6QhtmruxCcdIL+0XpldCAu8UaWHuqaTlX0wG:zfYh2oCtpXPdx2OqaewG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4624	3320	WerFault.exe	80

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 3320	4360	rundll32.exe	80
PID 4360 wrote to memory of 3320	4360	rundll32.exe	80
PID 4360 wrote to memory of 3320	4360	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\eff8e5129f5803851154f74b8dfb271d237d1a768b84687018b9b87e36425b66.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\eff8e5129f5803851154f74b8dfb271d237d1a768b84687018b9b87e36425b66.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3320 -s 624
    3⤵
    - Program crash
    PID:4624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3320 -ip 3320
1⤵
PID:4720