c054b65cf508ff04d36781183847c1c79826fffecb20e8ee27c869577fdbca0a

Analysis

max time kernel
144s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 08:10

Target

c054b65cf508ff04d36781183847c1c79826fffecb20e8ee27c869577fdbca0a.dll
Size

204KB
MD5

4139eb71217e9fcceac028bb53464f40
SHA1

d010a3c49e0135c408742d84d599ad0935318948
SHA256

c054b65cf508ff04d36781183847c1c79826fffecb20e8ee27c869577fdbca0a
SHA512

8d47546b6a6692782fd4e7351a9d1a10124238b42d599e11d9ff5530a4eeb5812934eae052cc2e00785f82d1c1e6c2e1cc3a457885ce8085eca01a6b3800e985
SSDEEP

3072:WTcX3qe6oZKyh++ZyVIJ4MSY1xyESEJNXo:3qe7Mu+6oIL1R7X

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2872	2640	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2640	2548	rundll32.exe	83
PID 2548 wrote to memory of 2640	2548	rundll32.exe	83
PID 2548 wrote to memory of 2640	2548	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c054b65cf508ff04d36781183847c1c79826fffecb20e8ee27c869577fdbca0a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c054b65cf508ff04d36781183847c1c79826fffecb20e8ee27c869577fdbca0a.dll,#1
  2⤵
  PID:2640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 588
    3⤵
    - Program crash
    PID:2872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2640 -ip 2640
1⤵
PID:3676