7bfc200a11c449c590df90f91d0d674400ff903b1bd235690279dc39a5cc8447

Analysis

max time kernel
150s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:54

Target

7bfc200a11c449c590df90f91d0d674400ff903b1bd235690279dc39a5cc8447.dll
Size

379KB
MD5

66cd1c28a6e859bce3f8dd7080aa6cbe
SHA1

02c666277fb799382f4d682d7f2ce3576673be58
SHA256

7bfc200a11c449c590df90f91d0d674400ff903b1bd235690279dc39a5cc8447
SHA512

c630a7a665ef75dae03f2a801eade303eeabeabe8dd84719a807ea3e5379ee4946b30f3ce5f877cab659ea85242c6cc8f6a87b929c7b29b95baae9c0838c4835
SSDEEP

6144:aQ3KzEf9OqLTCAPkMnFIrhZc4dMUStv71K1BqN9BdbTmM:Vi89NLuAPkMnAdY1KHqvvbT

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4112 4064 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4112	4064	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4908 wrote to memory of 4064	4908	rundll32.exe	rundll32.exe
PID 4908 wrote to memory of 4064	4908	rundll32.exe	rundll32.exe
PID 4908 wrote to memory of 4064	4908	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7bfc200a11c449c590df90f91d0d674400ff903b1bd235690279dc39a5cc8447.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4908

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7bfc200a11c449c590df90f91d0d674400ff903b1bd235690279dc39a5cc8447.dll,#1
2⤵
PID:4064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 580
3⤵
- Program crash
PID:4112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4064 -ip 4064
1⤵
PID:1284