83da63801acab0bb4df44d80ce20f6bc94026c3b41bbd9f7c963efea34cbbb89

Analysis

max time kernel
153s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2022 13:36

Target

83da63801acab0bb4df44d80ce20f6bc94026c3b41bbd9f7c963efea34cbbb89.dll
Size

72KB
MD5

0a783c911f443279af9fad52f4cc72f3
SHA1

45b9580eb27ccb5fbdbad4f824ed982265dd0df1
SHA256

83da63801acab0bb4df44d80ce20f6bc94026c3b41bbd9f7c963efea34cbbb89
SHA512

042fb7cb5a3128ee8150d27cc8e013480f387451919b759a03d5040d626b2eb9613789646fcbb01b9328da41ab10fe0219030490b26ceeb6c98d66d8d558cc45
SSDEEP

1536:MD7jQuJl5hfTVpP21XMVWCUUGBfX0b7540kkRZB+41zsPxMMkYaL:iRpPeXaWuu52lShaL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4424	3436	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 3436	4840	rundll32.exe	81
PID 4840 wrote to memory of 3436	4840	rundll32.exe	81
PID 4840 wrote to memory of 3436	4840	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\83da63801acab0bb4df44d80ce20f6bc94026c3b41bbd9f7c963efea34cbbb89.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\83da63801acab0bb4df44d80ce20f6bc94026c3b41bbd9f7c963efea34cbbb89.dll,#1
  2⤵
  PID:3436
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 560
    3⤵
    - Program crash
    PID:4424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3436 -ip 3436
1⤵
PID:4740

memory/3436-133-0x0000000010000000-0x0000000010682000-memory.dmp

Filesize
6.5MB

Download