efd1a86330cecba5d8d038fba65ac8e76955ed724986aa87cd6ca9f72f6941c7

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 08:28

Target

efd1a86330cecba5d8d038fba65ac8e76955ed724986aa87cd6ca9f72f6941c7.dll
Size

500KB
MD5

be231f7879d8d2159b67b7f277527268
SHA1

d73ca3707ebd61eff15dc25d9f439d6060553818
SHA256

efd1a86330cecba5d8d038fba65ac8e76955ed724986aa87cd6ca9f72f6941c7
SHA512

54ebf014160f0d5e1912d6495bc62e122296e055b548c90b63dabe1a24af6f29ec80d08eb7fe204702b2e263603f68c0e9f534e98917eb325b6dba524e20cb82
SSDEEP

6144:RQg1U4oSvkDjQ3cCT+jFa2QuoT50qWphYWxhaGqE:Rn1/ZcDM3d+a2QB0R/YWxQZE

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1932 1256 WerFault.exe rundll32.exe
4052 1256 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1932	1256	WerFault.exe	rundll32.exe
4052	1256	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 984 wrote to memory of 1256	984	rundll32.exe	rundll32.exe
PID 984 wrote to memory of 1256	984	rundll32.exe	rundll32.exe
PID 984 wrote to memory of 1256	984	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\efd1a86330cecba5d8d038fba65ac8e76955ed724986aa87cd6ca9f72f6941c7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:984

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\efd1a86330cecba5d8d038fba65ac8e76955ed724986aa87cd6ca9f72f6941c7.dll,#1
2⤵
PID:1256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 560
3⤵
- Program crash
PID:1932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 568
3⤵
- Program crash
PID:4052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1256 -ip 1256
1⤵
PID:2244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1256 -ip 1256
1⤵
PID:2524