ca990d69d4c5327b47b0879c0c18b5da523b7c42b0c2eaae7d1c2bbea14fa526

Analysis

max time kernel
182s
max time network
198s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:07

Target

ca990d69d4c5327b47b0879c0c18b5da523b7c42b0c2eaae7d1c2bbea14fa526.dll
Size

367KB
MD5

b967e8d2035df41dd9c17ed7e5033d35
SHA1

7c0f02dd0e88c211aca42f66d7c068d36553bb09
SHA256

ca990d69d4c5327b47b0879c0c18b5da523b7c42b0c2eaae7d1c2bbea14fa526
SHA512

345b55594c48b6d5c153ec6590e37b12c2ff91e5b688f55e1f95b14eb521855e368aae715b7ea903af42333dd8ed29b598ed8f4b3e7c5f00195a1a64d9276e91
SSDEEP

6144:NRzywnWbICLtBsyQmEy+oiaOBQF+vMnA7Izu98P6LmMUYct1:TzywnWbjchz8OiuNrRct1

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4432 4604 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4432	4604	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1040 wrote to memory of 4604	1040	rundll32.exe	rundll32.exe
PID 1040 wrote to memory of 4604	1040	rundll32.exe	rundll32.exe
PID 1040 wrote to memory of 4604	1040	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca990d69d4c5327b47b0879c0c18b5da523b7c42b0c2eaae7d1c2bbea14fa526.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1040

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca990d69d4c5327b47b0879c0c18b5da523b7c42b0c2eaae7d1c2bbea14fa526.dll,#1
2⤵
PID:4604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 576
3⤵
- Program crash
PID:4432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4604 -ip 4604
1⤵
PID:4488