ebdf249130cf3bf2069f6ba82d6ef5f19457ba6b65fb403f77a3340b4cebd1b4

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30-10-2022 05:53

Target

ebdf249130cf3bf2069f6ba82d6ef5f19457ba6b65fb403f77a3340b4cebd1b4.dll
Size

335KB
MD5

93825f1151274a2f6f2758574affb6c9
SHA1

3b9b02f09690d13ea8bf77e921b7d6784957a56e
SHA256

ebdf249130cf3bf2069f6ba82d6ef5f19457ba6b65fb403f77a3340b4cebd1b4
SHA512

9ed333b61b604d0cfd002bd2c422b22c8890b81fdd4230393ce75da35ba144dba531d48d48409674f48b74ffd5388744b44a80fbbf5eee1d09222838342a590c
SSDEEP

6144:b2RCAOQI+7dfKzhBg3BU9MESibsQkzCEPFMniF+NrbsYgWeXL:ACG17dfergK9MESioLmEcq0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4136	5080	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 5080	4960	rundll32.exe	81
PID 4960 wrote to memory of 5080	4960	rundll32.exe	81
PID 4960 wrote to memory of 5080	4960	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ebdf249130cf3bf2069f6ba82d6ef5f19457ba6b65fb403f77a3340b4cebd1b4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ebdf249130cf3bf2069f6ba82d6ef5f19457ba6b65fb403f77a3340b4cebd1b4.dll,#1
  2⤵
  PID:5080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 548
    3⤵
    - Program crash
    PID:4136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5080 -ip 5080
1⤵
PID:4832