79bd24679509a1b7cb0bbc395a071602546165fdb42b1cbdfc7fd4e81eb81719

Analysis

max time kernel
165s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:55

Target

79bd24679509a1b7cb0bbc395a071602546165fdb42b1cbdfc7fd4e81eb81719.dll
Size

375KB
MD5

20b546a2a24c41374c28d513a943d743
SHA1

54b84ca93687376abb53a51bfd1dac8d545a48f2
SHA256

79bd24679509a1b7cb0bbc395a071602546165fdb42b1cbdfc7fd4e81eb81719
SHA512

89465a08446eeb435b6eabd4f1510657a196884d5a9e6da9cb04e44dbc5085cbb6df52f78536c47833c68799e3b4d16e7c17bb1abd90c325a281a3f71cbb151c
SSDEEP

6144:0cjdZ9l6L3hi/CrSUhiJS+f/alRUJA20eNbTsVg3DnLzuPX+XJ/tK6VOiyzJaVCf:0M0eC+AIS+f2UJH0Yig3DLzSX+Jt9NIP

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4300 1308 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4300	1308	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4944 wrote to memory of 1308	4944	rundll32.exe	rundll32.exe
PID 4944 wrote to memory of 1308	4944	rundll32.exe	rundll32.exe
PID 4944 wrote to memory of 1308	4944	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\79bd24679509a1b7cb0bbc395a071602546165fdb42b1cbdfc7fd4e81eb81719.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\79bd24679509a1b7cb0bbc395a071602546165fdb42b1cbdfc7fd4e81eb81719.dll,#1
  2⤵
  PID:1308
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 580
    3⤵
    - Program crash
    PID:4300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1308 -ip 1308
1⤵
PID:2372