a965a5bf505420a90156f16ba08c5b8a2585217aa59db882295fe4d37e4a817d

Analysis

max time kernel
180s
max time network
204s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:27

Target

a965a5bf505420a90156f16ba08c5b8a2585217aa59db882295fe4d37e4a817d.dll
Size

72KB
MD5

3f084db45b2737d83cea9b84cf7bdcc8
SHA1

2fb11de4001cc9b66a717fcb9aac1948fc84e7a7
SHA256

a965a5bf505420a90156f16ba08c5b8a2585217aa59db882295fe4d37e4a817d
SHA512

b8fce6d2b9174959a4571dc2e096bf2318ac432b797168a17b7b3ac822b9e763ee25fbadb34f1af44a9f417668e933355bdca623ea3c0b0ee5b4255f16f88175
SSDEEP

1536:pqJJyP9okCSg3ShThtLrmXxs4PMOdxn/2TtvYx:irx+sxs4PDdxn/2Gx

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3716 5116 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3716	5116	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4540 wrote to memory of 5116	4540	rundll32.exe	rundll32.exe
PID 4540 wrote to memory of 5116	4540	rundll32.exe	rundll32.exe
PID 4540 wrote to memory of 5116	4540	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a965a5bf505420a90156f16ba08c5b8a2585217aa59db882295fe4d37e4a817d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4540

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a965a5bf505420a90156f16ba08c5b8a2585217aa59db882295fe4d37e4a817d.dll,#1
2⤵
PID:5116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5116 -s 608
3⤵
- Program crash
PID:3716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5116 -ip 5116
1⤵
PID:1264