3ac9336fac8e7a22e1db4caa56e277d2d8aa12c9ffe4b7b4b833b2f8ae70e669

Analysis

max time kernel
173s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2022, 13:51

Target
3ac9336fac8e7a22e1db4caa56e277d2d8aa12c9ffe4b7b4b833b2f8ae70e669.dll
Size 603KB
Sample221019-q5415saec7
SHA256 3ac9336fac8e7a22e1db4caa56e277d2d8aa12c9ffe4b7b4b833b2f8ae70e669
MD5 91381815b188d68f8d6ac15704d23354
SHA1 8fbcd464587ba26e1e2883e54a7017e77329e0a7
SHA512 f81c1a93a2d670db403bf725a1229f2e63af94a6711a4f1cd1d8b9eaee0f83ed9390a7ca7c152e0cd8870aedea8c3ea6084b4b647c56619e13954151624f521c
SSDEEP 6144:Ob2HnveeTMmk+5Ky1O1/3baIJ+Qh0OXx53q7:GknsF+511O1/baIJ+Qh/
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1288	4980	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 4980	5016	rundll32.exe	82
PID 5016 wrote to memory of 4980	5016	rundll32.exe	82
PID 5016 wrote to memory of 4980	5016	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ac9336fac8e7a22e1db4caa56e277d2d8aa12c9ffe4b7b4b833b2f8ae70e669.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ac9336fac8e7a22e1db4caa56e277d2d8aa12c9ffe4b7b4b833b2f8ae70e669.dll,#1
  2⤵
  PID:4980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 544
    3⤵
    - Program crash
    PID:1288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4980 -ip 4980
1⤵
PID:1260