d7e97911b5f62b564ddcf638bf1bcaed5f7703253b8924bee25b34ac4b819a06

Analysis

max time kernel
138s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 11:09

Target

d7e97911b5f62b564ddcf638bf1bcaed5f7703253b8924bee25b34ac4b819a06.dll
Size

86KB
MD5

f48353d1e2b7644e68f86ad8b3c7d7f3
SHA1

db6c34548e54dbec30b74277ec363348aaf7140e
SHA256

d7e97911b5f62b564ddcf638bf1bcaed5f7703253b8924bee25b34ac4b819a06
SHA512

00a6049feaf1b8ea9e6b545c2971527f6344a927c4a8ee6f0346e7a1ebb428eaf803bea76b106052794c6dd7ae0d33688b9eb98cbe0401d53a5d00c9ff152919
SSDEEP

1536:qHWkW14D4qmMtpwhismuozMBNLZd26lJLmpY02JdATVMZ+b0Fbh:Vz+wismuoQPLZdvm32vUCh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4100	3416	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 3416	4792	rundll32.exe	81
PID 4792 wrote to memory of 3416	4792	rundll32.exe	81
PID 4792 wrote to memory of 3416	4792	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d7e97911b5f62b564ddcf638bf1bcaed5f7703253b8924bee25b34ac4b819a06.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d7e97911b5f62b564ddcf638bf1bcaed5f7703253b8924bee25b34ac4b819a06.dll,#1
  2⤵
  PID:3416
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 580
    3⤵
    - Program crash
    PID:4100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 3416 -ip 3416
1⤵
PID:1168