ae991304c37d1e3ab3194ffb602e2de38c0a9bb37f6dee3b6fb150c51e8cd6e8

Analysis

max time kernel
62s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 18:25

Target

ae991304c37d1e3ab3194ffb602e2de38c0a9bb37f6dee3b6fb150c51e8cd6e8.dll
Size

52KB
MD5

81d7f9781a55b0fd107afeb67614cd38
SHA1

155af242dd0366a01f7a34b3cd3e34375c0e6dcc
SHA256

ae991304c37d1e3ab3194ffb602e2de38c0a9bb37f6dee3b6fb150c51e8cd6e8
SHA512

23dd17d291b281f8ebffe0f20590be1f54d0d7731e9cfe34d3818628dba43df6c397cb50171bf65aeaf38223bcf86b9e76a125f586486713bf8ae534b5f5af77
SSDEEP

768:s54HeMv33/CQ6FFmGuyO1yUIuoFEmc8kVk4o91:s5advfCdFuyOUUv1fXDo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2348	3536	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 3536	1612	rundll32.exe	83
PID 1612 wrote to memory of 3536	1612	rundll32.exe	83
PID 1612 wrote to memory of 3536	1612	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae991304c37d1e3ab3194ffb602e2de38c0a9bb37f6dee3b6fb150c51e8cd6e8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae991304c37d1e3ab3194ffb602e2de38c0a9bb37f6dee3b6fb150c51e8cd6e8.dll,#1
  2⤵
  PID:3536
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3536 -s 548
    3⤵
    - Program crash
    PID:2348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3536 -ip 3536
1⤵
PID:384