2a8c47a717dfc5924def776973ff896704444eb1ea33342756b497280f8ac972

Analysis

max time kernel
151s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2022, 15:53

Target
af4929548594e7adcfceace9d201510651bab248e5ee43d3411593daac809e06.dll
Size 2.7MB
Sample221012-tbm3baabf6
SHA256 af4929548594e7adcfceace9d201510651bab248e5ee43d3411593daac809e06
MD5 14a373d19732961e4fcc1444c2949989
SHA1 78bf059b72bec0376fb9279ff406abfbee5f1e7e
SHA512 e836644f5ea7013d12a80765226ecbc94dcf6d0c95e91eadd369fa2279e1a24b7dbdc73dad91c23e4bb9859e5685c3e3b23207d4fd028afd96c0f25a9f805c1a
SSDEEP 49152:leSypsReC6LyKs5NSDWf3yHU/9trIPD4:IScC6LyFXaHU/9trIP
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4076	1016	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 1016	992	rundll32.exe	83
PID 992 wrote to memory of 1016	992	rundll32.exe	83
PID 992 wrote to memory of 1016	992	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\af4929548594e7adcfceace9d201510651bab248e5ee43d3411593daac809e06.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\af4929548594e7adcfceace9d201510651bab248e5ee43d3411593daac809e06.dll,#1
  2⤵
  PID:1016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 560
    3⤵
    - Program crash
    PID:4076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1016 -ip 1016
1⤵
PID:5036