2a8c47a717dfc5924def776973ff896704444eb1ea33342756b497280f8ac972

Analysis

max time kernel
137s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2022, 15:54

Target
af4929548594e7adcfceace9d201510651bab248e5ee43d3411593daac809e06.dll
Size 2.7MB
Sample221012-tcpbrsacb8
SHA256 af4929548594e7adcfceace9d201510651bab248e5ee43d3411593daac809e06
MD5 14a373d19732961e4fcc1444c2949989
SHA1 78bf059b72bec0376fb9279ff406abfbee5f1e7e
SHA512 e836644f5ea7013d12a80765226ecbc94dcf6d0c95e91eadd369fa2279e1a24b7dbdc73dad91c23e4bb9859e5685c3e3b23207d4fd028afd96c0f25a9f805c1a
SSDEEP 49152:leSypsReC6LyKs5NSDWf3yHU/9trIPD4:IScC6LyFXaHU/9trIP
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4820	4624	WerFault.exe	82
4576	4624	WerFault.exe	82

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 4624	2800	rundll32.exe	82
PID 2800 wrote to memory of 4624	2800	rundll32.exe	82
PID 2800 wrote to memory of 4624	2800	rundll32.exe	82
PID 4624 wrote to memory of 4820	4624	rundll32.exe	86
PID 4624 wrote to memory of 4820	4624	rundll32.exe	86
PID 4624 wrote to memory of 4820	4624	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\af4929548594e7adcfceace9d201510651bab248e5ee43d3411593daac809e06.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\af4929548594e7adcfceace9d201510651bab248e5ee43d3411593daac809e06.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 560
    3⤵
    - Program crash
    PID:4820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 560
    3⤵
    - Program crash
    PID:4576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4624 -ip 4624
1⤵
PID:3904