d95292ec3525f8f28de3e01cd9e3b6bc9f7d7d47a976c702423c3aa8e75d5dc6

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 10:08

Target

d95292ec3525f8f28de3e01cd9e3b6bc9f7d7d47a976c702423c3aa8e75d5dc6.dll
Size

772KB
MD5

085bbd028b37eec3d39aff02f7dcdab0
SHA1

aa6fde7ea28673819667e6e7a3c8b5cec566e4b1
SHA256

d95292ec3525f8f28de3e01cd9e3b6bc9f7d7d47a976c702423c3aa8e75d5dc6
SHA512

abb2b7a3ec4bb87456280b9b9355120d91d83dbbfd62e791660a666a516df771bffcff951d216c8245a9ff8b1d289416a895dc12a11452a71b34115e79822895
SSDEEP

12288:TX2TZnynE03rJ54VHl0eitSnkBx0YYJnJopQ4XnM3Xn:TX2T9mrCkAcrAWuTX

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1972	4840	WerFault.exe	80
1420	4840	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 4840	4824	rundll32.exe	80
PID 4824 wrote to memory of 4840	4824	rundll32.exe	80
PID 4824 wrote to memory of 4840	4824	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d95292ec3525f8f28de3e01cd9e3b6bc9f7d7d47a976c702423c3aa8e75d5dc6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d95292ec3525f8f28de3e01cd9e3b6bc9f7d7d47a976c702423c3aa8e75d5dc6.dll,#1
  2⤵
  PID:4840
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 600
    3⤵
    - Program crash
    PID:1972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 608
    3⤵
    - Program crash
    PID:1420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4840 -ip 4840
1⤵
PID:3928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4840 -ip 4840
1⤵
PID:3604