bd7fe96fd7eb8c45e9492db9752d6bb1fb832fcd6959c69957905ff0d0b6b8b8

Analysis

max time kernel
91s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 23:52

Target

bd7fe96fd7eb8c45e9492db9752d6bb1fb832fcd6959c69957905ff0d0b6b8b8.dll
Size

73KB
MD5

44ec9fb882950a8b2749a6e30a1ec6c0
SHA1

8f52df0ab9a58d0dcadede99da400e604eaea90f
SHA256

bd7fe96fd7eb8c45e9492db9752d6bb1fb832fcd6959c69957905ff0d0b6b8b8
SHA512

28755e0bbf1595a32ffabcc0e02be4ade5c34401579f9913b5780e1fde5f2ff8554b3626bc48801edb75b58dbe7afd550bcf0510d99574988e679c74b7d9519c
SSDEEP

1536:qu0s+S3laAGcvKen/VFnToIfITRur5Z5NTeiFp0zA+V/R8:f0s+Sien/VtTBfITRur5Z5NTeiP0Z

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4984 3796 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4984	3796	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4512 wrote to memory of 3796	4512	rundll32.exe	rundll32.exe
PID 4512 wrote to memory of 3796	4512	rundll32.exe	rundll32.exe
PID 4512 wrote to memory of 3796	4512	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd7fe96fd7eb8c45e9492db9752d6bb1fb832fcd6959c69957905ff0d0b6b8b8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4512

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd7fe96fd7eb8c45e9492db9752d6bb1fb832fcd6959c69957905ff0d0b6b8b8.dll,#1
2⤵
PID:3796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 684
3⤵
- Program crash
PID:4984

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k krnlsrvc
1⤵
PID:2444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3796 -ip 3796
1⤵
PID:5068