b7cdab0ca8f2cb71f624941ce0c002d0f60045bed766e05e532553462d7d0233

Analysis

max time kernel
120s
max time network
57s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 00:11

Target

b7cdab0ca8f2cb71f624941ce0c002d0f60045bed766e05e532553462d7d0233.dll
Size

76KB
MD5

096adadaa4695ab749fc820b8e00b070
SHA1

691e375c94290847972ad8920807fab78d23091d
SHA256

b7cdab0ca8f2cb71f624941ce0c002d0f60045bed766e05e532553462d7d0233
SHA512

584571c70022f55d941d83a8b61fe4a6243cc1379b00983556acc829ce3282b44c81c9bd4ab53b22237e73ae0f750a0e1ca2a7b6aee913d5a0432b8d0f42fc22
SSDEEP

768:U07i/PixctLYPQ3lwpnOYgkyNmcxTCcxT5o:U07iH/3lltNmcxTCcxT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4680	5004	WerFault.exe	62

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 5004	4936	rundll32.exe	62
PID 4936 wrote to memory of 5004	4936	rundll32.exe	62
PID 4936 wrote to memory of 5004	4936	rundll32.exe	62

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b7cdab0ca8f2cb71f624941ce0c002d0f60045bed766e05e532553462d7d0233.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b7cdab0ca8f2cb71f624941ce0c002d0f60045bed766e05e532553462d7d0233.dll,#1
  2⤵
  PID:5004
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 636
    3⤵
    - Program crash
    PID:4680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5004 -ip 5004
1⤵
PID:1524