568539b8776f6ac3e83c8fe967415c08b110ba3a62eaf5254e431d6bb7e31071

Analysis

max time kernel
139s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2022, 18:43

Target

568539b8776f6ac3e83c8fe967415c08b110ba3a62eaf5254e431d6bb7e31071.dll
Size

512KB
MD5

c0d3a9519b99e5ba7b1f2ac0c8bc7ca2
SHA1

b982cdb132c06a101c96271f0783c43d658c1770
SHA256

568539b8776f6ac3e83c8fe967415c08b110ba3a62eaf5254e431d6bb7e31071
SHA512

0b869508d5ac6c0e423654f6a777413dad8fa82f2f77c54b88cc4508a88dea3876bd0072d302b0ec28cd67bb41f15f39a5e354287c2d379af8669b700672d73e
SSDEEP

6144:vslZ0VZXqjGbTtqqqqqqqqqqqqqqqqqqqqqqqqqSDukM7o:kunPN4E

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4780	4988	WerFault.exe	21

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 4988	2444	rundll32.exe	21
PID 2444 wrote to memory of 4988	2444	rundll32.exe	21
PID 2444 wrote to memory of 4988	2444	rundll32.exe	21

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\568539b8776f6ac3e83c8fe967415c08b110ba3a62eaf5254e431d6bb7e31071.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\568539b8776f6ac3e83c8fe967415c08b110ba3a62eaf5254e431d6bb7e31071.dll,#1
  2⤵
  PID:4988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 556
    3⤵
    - Program crash
    PID:4780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 4988 -ip 4988
1⤵
PID:4196