aebe50bc5e16e1c5e35de75cf3bf736acf82584b5680d1fc9f047208669b945b

Analysis

max time kernel
85s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2022, 21:57

Target

aebe50bc5e16e1c5e35de75cf3bf736acf82584b5680d1fc9f047208669b945b.dll
Size

373KB
MD5

a0beeb52258e910205ca62a60cafb55e
SHA1

8f50c8c51e1a82d1582311cdb55440b2dba09ddf
SHA256

aebe50bc5e16e1c5e35de75cf3bf736acf82584b5680d1fc9f047208669b945b
SHA512

380bb0792ae66a50fafecf663a58c885dee57e9c69ec2671008f4656f1c004e5d27509f8fa85570195b1e8b730df894a093f02b9666ad1aee30ff8d7b62f088e
SSDEEP

6144:uSfVoOZolbsTuigT/pF5Sfqm2rSL9olcd4rQ7QTzE7lv2M7m0jKUxuR5:usDoyuiepjSfqAaQQTzuO0m0nI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2204	1584	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 1584	1884	rundll32.exe	83
PID 1884 wrote to memory of 1584	1884	rundll32.exe	83
PID 1884 wrote to memory of 1584	1884	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aebe50bc5e16e1c5e35de75cf3bf736acf82584b5680d1fc9f047208669b945b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\aebe50bc5e16e1c5e35de75cf3bf736acf82584b5680d1fc9f047208669b945b.dll,#1
  2⤵
  PID:1584
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1584 -s 580
    3⤵
    - Program crash
    PID:2204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1584 -ip 1584
1⤵
PID:452