1b3582dfdf5d1d2324b67847f2c7415d21f40f19fb378bff9a3cc1f7edd27124

Analysis

max time kernel
91s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 17:12

Target

1b3582dfdf5d1d2324b67847f2c7415d21f40f19fb378bff9a3cc1f7edd27124.dll
Size

168KB
MD5

96044bf435759b4f1855347b7be90d36
SHA1

caeecd8131840698633287c7ea49110ea779f751
SHA256

1b3582dfdf5d1d2324b67847f2c7415d21f40f19fb378bff9a3cc1f7edd27124
SHA512

3a6882c54fdf431d3826185c8cea48cdce27266e1353a69ff91c6b9eb3b3fe2790fa3c9b870307d8c590fe8c4c70f739f27d91bfa41d44c87926dbdba4be8f7a
SSDEEP

3072:L7hM2O8PvN8rw24smepxAW/wqYYwpvFPnSHiOFICP1zBBP2pHVG:11+v4JOAWdYYwNFPnDOFICddQ5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4364	4936	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 4936	4896	rundll32.exe	83
PID 4896 wrote to memory of 4936	4896	rundll32.exe	83
PID 4896 wrote to memory of 4936	4896	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b3582dfdf5d1d2324b67847f2c7415d21f40f19fb378bff9a3cc1f7edd27124.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b3582dfdf5d1d2324b67847f2c7415d21f40f19fb378bff9a3cc1f7edd27124.dll,#1
  2⤵
  PID:4936
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 588
    3⤵
    - Program crash
    PID:4364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4936 -ip 4936
1⤵
PID:4156