f5d911dfc969d6d89f8f3f1dc6cab5de43620443b177473a37d0a81ef80317b4

Analysis

max time kernel
152s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2022 09:23

Target

f5d911dfc969d6d89f8f3f1dc6cab5de43620443b177473a37d0a81ef80317b4.dll
Size

128KB
MD5

085f9c1d660c374c6051e1e7e602d28b
SHA1

36454d715f5d3913f58a51979826514a92c6e3a4
SHA256

f5d911dfc969d6d89f8f3f1dc6cab5de43620443b177473a37d0a81ef80317b4
SHA512

fd228c9dbedad25d580bae59162877ed178d5a12cc0d46e24a15e9fd0d48c5407453e5b41446fd9f14e99e024f842909f6d65851304889212fb90b3dc1e4fc3b
SSDEEP

3072:Cb6YGQ6PbTVOlsN+NeaVwHw7SfxvLsm7rGEG1kvQ0rjbn/BSVR:ilI7U4w7SWmfGEZPP0VR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4680	3708	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 3708	4464	rundll32.exe	79
PID 4464 wrote to memory of 3708	4464	rundll32.exe	79
PID 4464 wrote to memory of 3708	4464	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f5d911dfc969d6d89f8f3f1dc6cab5de43620443b177473a37d0a81ef80317b4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f5d911dfc969d6d89f8f3f1dc6cab5de43620443b177473a37d0a81ef80317b4.dll,#1
  2⤵
  PID:3708
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3708 -s 640
    3⤵
    - Program crash
    PID:4680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 3708 -ip 3708
1⤵
PID:3024