043b17b0abbca3e737b79678f29f0f4842041d76c65e0c741ac093b2faa83212

Analysis

max time kernel
104s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2022, 09:05

Target
043b17b0abbca3e737b79678f29f0f4842041d76c65e0c741ac093b2faa83212.dll
Size 124KB
Sample221014-k2g5bagfd9
SHA256 043b17b0abbca3e737b79678f29f0f4842041d76c65e0c741ac093b2faa83212
MD5 6c5dc9ceb186d2e9a577f9da657a0f98
SHA1 40d03327cc9edc531912254818179e8f03d083db
SHA512 8283f6bdeafaca4cd9ee118f9feaeaf06c12848d8b428a3604a5c7eec6378a465ca0d3d72daec02ad1ae89a1b9c5b7ad3ac0db52340c45018ce71356f415abf7
SSDEEP 3072:OEa9Vrl+LiVrQaU3Z+tH/vPtcVVVVekQ:Or95lPUU5R
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4496	1472	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3168 wrote to memory of 1472	3168	rundll32.exe	80
PID 3168 wrote to memory of 1472	3168	rundll32.exe	80
PID 3168 wrote to memory of 1472	3168	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\043b17b0abbca3e737b79678f29f0f4842041d76c65e0c741ac093b2faa83212.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\043b17b0abbca3e737b79678f29f0f4842041d76c65e0c741ac093b2faa83212.dll,#1
  2⤵
  PID:1472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 544
    3⤵
    - Program crash
    PID:4496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1472 -ip 1472
1⤵
PID:3536