bc9a78aeabaf30360dc93e64cc3b1428f48b18669e909911c4deb7abdd8a4a80

Analysis

max time kernel
152s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 04:55

Target

bc9a78aeabaf30360dc93e64cc3b1428f48b18669e909911c4deb7abdd8a4a80.dll
Size

1.0MB
MD5

0a4f73d54adbcc94b96a17d6914675b0
SHA1

b2f7a93b05b8dd2a2358b475adf5ebfde6cc81d6
SHA256

bc9a78aeabaf30360dc93e64cc3b1428f48b18669e909911c4deb7abdd8a4a80
SHA512

46e698422d24b6264652961f4ea381c753e3f983445fe5d428c4667f05d5949fb5b18432319346bf3aedfa25c09109c18e0e59ddbb31ea17166ce6494f65519d
SSDEEP

1536:tOGC0lvO/1jNOTyoIUqf6E1sFwXb+Pf6btKNn:tRCoCNCPYXb+qbtK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4912	456	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 456	4960	rundll32.exe	80
PID 4960 wrote to memory of 456	4960	rundll32.exe	80
PID 4960 wrote to memory of 456	4960	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc9a78aeabaf30360dc93e64cc3b1428f48b18669e909911c4deb7abdd8a4a80.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc9a78aeabaf30360dc93e64cc3b1428f48b18669e909911c4deb7abdd8a4a80.dll,#1
  2⤵
  PID:456
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 584
    3⤵
    - Program crash
    PID:4912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 456 -ip 456
1⤵
PID:4012