b45d572ab5d4ddb1dcdd71daccb2e8a884a8a89df87ae3a6e0b34994bf4d57ab

Analysis

max time kernel
131s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 01:25

Target

b45d572ab5d4ddb1dcdd71daccb2e8a884a8a89df87ae3a6e0b34994bf4d57ab.dll
Size

123KB
MD5

0e2ee0ecceaecffb9178332ab174be90
SHA1

1ebe74301b7084bdaa514f5a8c51d14158c553d9
SHA256

b45d572ab5d4ddb1dcdd71daccb2e8a884a8a89df87ae3a6e0b34994bf4d57ab
SHA512

bc5ba40014c950d6099faa52bd8f57233081d72d68afb8eae470b230ef1ed7a96d38e5d69e48eae5237283d10c5bd8794a660f61643b701f45f6766cd5d160a9
SSDEEP

3072:YkTUoOajm1U+5zSWr9Xv3mB3j3oF6YtKwmkaxQS46fZxW4jB:gaYU+RZ+Vj3UdhAxQyfzB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2032	2324	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2324	3008	rundll32.exe	83
PID 3008 wrote to memory of 2324	3008	rundll32.exe	83
PID 3008 wrote to memory of 2324	3008	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b45d572ab5d4ddb1dcdd71daccb2e8a884a8a89df87ae3a6e0b34994bf4d57ab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b45d572ab5d4ddb1dcdd71daccb2e8a884a8a89df87ae3a6e0b34994bf4d57ab.dll,#1
  2⤵
  PID:2324
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 584
    3⤵
    - Program crash
    PID:2032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2324 -ip 2324
1⤵
PID:1496