ef8038b4a6deb6f326f8412cd10d0bf67d148dcbda757abbb26b97ff48e3ea39

Analysis

max time kernel
114s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:45

Target

ef8038b4a6deb6f326f8412cd10d0bf67d148dcbda757abbb26b97ff48e3ea39.dll
Size

52KB
MD5

af13adda97d663e73cd3f84271ee4f99
SHA1

fc04104a3b1f0293ccae860a885f7fe9cf6805ec
SHA256

ef8038b4a6deb6f326f8412cd10d0bf67d148dcbda757abbb26b97ff48e3ea39
SHA512

0b6c90d2f756ca9d673d029317262b302b1604a7dae72b5fa93254c8bcd05aaeadad617eb88557a71333b97b5bdba6373e58178e6393dc22ec80900abefd8837
SSDEEP

768:w/6hTRyNSIluiWzXQSh0OMgnPH9iQmgu985fQK86yYjUEiily03eXo9eJi6:wyhty/7WzR210cMuDK+YjUEiiEsiogT

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4444 3796 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4444	3796	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4512 wrote to memory of 3796	4512	rundll32.exe	rundll32.exe
PID 4512 wrote to memory of 3796	4512	rundll32.exe	rundll32.exe
PID 4512 wrote to memory of 3796	4512	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ef8038b4a6deb6f326f8412cd10d0bf67d148dcbda757abbb26b97ff48e3ea39.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4512

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ef8038b4a6deb6f326f8412cd10d0bf67d148dcbda757abbb26b97ff48e3ea39.dll,#1
2⤵
PID:3796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 572
3⤵
- Program crash
PID:4444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3796 -ip 3796
1⤵
PID:2688