021e9657a44646a4463289d673386cdcdc4cbe4515411d5a8f92318e7450bf7d

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 23:11

Target

021e9657a44646a4463289d673386cdcdc4cbe4515411d5a8f92318e7450bf7d.dll
Size

52KB
MD5

48535dbe43999076d54d1148ae8cfb27
SHA1

42ae7c509ddb0d1df68c5b3e051ed49d2bcbe26d
SHA256

021e9657a44646a4463289d673386cdcdc4cbe4515411d5a8f92318e7450bf7d
SHA512

d245b37cf5bf6a3bdb7993f3b02e6748c0b1df72d58c8bf27d90792df55e1b9a9f96603f6eb41c90df619540309114b04f5e94c6e447c66914ee2f02913e0206
SSDEEP

768:TbDHyISzDYRx7YX5sBMxnnkw1D44EVjTtsN5rerzGhrmLOkTEyDxNqqYTQW:TaRIRxkX5sC1ctjTtSry4KFguN5YTQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4984	1236	WerFault.exe	78

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 1236	4976	rundll32.exe	78
PID 4976 wrote to memory of 1236	4976	rundll32.exe	78
PID 4976 wrote to memory of 1236	4976	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\021e9657a44646a4463289d673386cdcdc4cbe4515411d5a8f92318e7450bf7d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\021e9657a44646a4463289d673386cdcdc4cbe4515411d5a8f92318e7450bf7d.dll,#1
  2⤵
  PID:1236
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 568
    3⤵
    - Program crash
    PID:4984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1236 -ip 1236
1⤵
PID:4596