45d19fec66a7d021543a4581fcd5c851ced47bb2cbf612e739ef30f31a02bed4

Analysis

max time kernel
97s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2022, 21:03

Target

45d19fec66a7d021543a4581fcd5c851ced47bb2cbf612e739ef30f31a02bed4.dll
Size

310KB
MD5

95e1939028aee7079af24b581bf11e25
SHA1

c87d6a04fe0c41685c66c64a22a607e2919d9384
SHA256

45d19fec66a7d021543a4581fcd5c851ced47bb2cbf612e739ef30f31a02bed4
SHA512

6f19a38545aec775543c46c6b6dccdb9efc1f5e67e16c5f46e5698dd65ab6932f334f48b36f9e22fef56684ce4f0dbefa0a52ab36bc4da81c72729aae9f64096
SSDEEP

6144:pmylhP+0ZyNwf/JZ+CdUDCtwK6XUCsIHpGdvJBpKH143Fd3EeEj1S3EvsiNscp:dhP/zf/JZGXnTsIJOJBpKH1eFFFeDvs6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1072	4056	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 4056	1176	rundll32.exe	83
PID 1176 wrote to memory of 4056	1176	rundll32.exe	83
PID 1176 wrote to memory of 4056	1176	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\45d19fec66a7d021543a4581fcd5c851ced47bb2cbf612e739ef30f31a02bed4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\45d19fec66a7d021543a4581fcd5c851ced47bb2cbf612e739ef30f31a02bed4.dll,#1
  2⤵
  PID:4056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4056 -s 644
    3⤵
    - Program crash
    PID:1072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4056 -ip 4056
1⤵
PID:4544