27563ae0c688c87ae5d97846d6f0365d54930d31f5ca644e0eafd86fc2366c5b

Analysis

max time kernel
93s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20-10-2022 20:33

Target

27563ae0c688c87ae5d97846d6f0365d54930d31f5ca644e0eafd86fc2366c5b.dll
Size

148KB
MD5

7bff906d31ca1c2fb885a007e6b8b946
SHA1

6f71203969841ae43afe436f0091bfb68c27a7a0
SHA256

27563ae0c688c87ae5d97846d6f0365d54930d31f5ca644e0eafd86fc2366c5b
SHA512

b79a5f79fe2e5c4e42a3f5f7dc66e8e9bb84759da2c0eb9001d236aa85e9ac5be673b889dca2dec6eb6741d832f3537f8dc7fdfb40ebd4f16f25285f2c1cad72
SSDEEP

3072:kOHE31vHHuwv74gbNHcks6FENT/7JLuTMq0Bft4qfUHt4rw5zI:LklWwvlHjKbNuTMq0BlVfUHt4rQI

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\rundll32.exe.txt	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4428	3896	WerFault.exe	78

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 3896	2912	rundll32.exe	78
PID 2912 wrote to memory of 3896	2912	rundll32.exe	78
PID 2912 wrote to memory of 3896	2912	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\27563ae0c688c87ae5d97846d6f0365d54930d31f5ca644e0eafd86fc2366c5b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\27563ae0c688c87ae5d97846d6f0365d54930d31f5ca644e0eafd86fc2366c5b.dll,#1
  2⤵
  - Drops file in System32 directory
  PID:3896
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 628
    3⤵
    - Program crash
    PID:4428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3896 -ip 3896
1⤵
PID:4364