bee2403020f18e0c73607caadbf5dad6a79ae2eb037fa078476a510f3746a7ca

Analysis

max time kernel
102s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 20:27

Target

bee2403020f18e0c73607caadbf5dad6a79ae2eb037fa078476a510f3746a7ca.dll
Size

112KB
MD5

5fe97e6ea9f6fbf6d5bc893b060e2529
SHA1

9da6fd61712a8b92d767ad0396cb19791e254c36
SHA256

bee2403020f18e0c73607caadbf5dad6a79ae2eb037fa078476a510f3746a7ca
SHA512

db341d804f3a1fa56e1d462db4632f6140c2fe22edf4c0d6fca18dad9bb516ccac5be8719da5dd5caccfb6be3b5357a58db3bfa0344ddf80cdb488b896bf9c3e
SSDEEP

3072:+gAG47YsyLGiB4Xu8Q5ddAPbbcSezwU861IO:+gA7YsyyZe4PcVwFc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1892	4408	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 4408	4960	rundll32.exe	84
PID 4960 wrote to memory of 4408	4960	rundll32.exe	84
PID 4960 wrote to memory of 4408	4960	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bee2403020f18e0c73607caadbf5dad6a79ae2eb037fa078476a510f3746a7ca.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bee2403020f18e0c73607caadbf5dad6a79ae2eb037fa078476a510f3746a7ca.dll,#1
  2⤵
  PID:4408
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 644
    3⤵
    - Program crash
    PID:1892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4408 -ip 4408
1⤵
PID:5080