4a2d9062985debbff2494e158c66f26fe95d61a48900c47ff7a744d012e6f576

Analysis

max time kernel
91s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23/10/2022, 17:47

Target
09069ada2901baf7354f44d097996698.dll
Size 2.7MB
Sample221023-wcvjwsbfdj
SHA256 4a2d9062985debbff2494e158c66f26fe95d61a48900c47ff7a744d012e6f576
MD5 09069ada2901baf7354f44d097996698
SHA1 32cef9ae388d149495d48d840377eb3d20803b48
SHA512 c8ec99606e5d67f2297cdbb9b68a4c88fd373b361bea4edc0065fc8b26e58442bc0491c815cf85bb3bd81f1b5d5dab6cc0a4d88682697c404534f4a7c438f1f6
SSDEEP 49152:Jzl1rpbUrqvv0v2rQVt8nqwI7lOOYc52ek:P1Kqvv07noI7lOOYcL
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
752	2040	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 2040	4768	rundll32.exe	81
PID 4768 wrote to memory of 2040	4768	rundll32.exe	81
PID 4768 wrote to memory of 2040	4768	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\09069ada2901baf7354f44d097996698.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\09069ada2901baf7354f44d097996698.dll,#1
  2⤵
  PID:2040
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 560
    3⤵
    - Program crash
    PID:752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2040 -ip 2040
1⤵
PID:4452