a6a5f092920850619f20649918e0e20394d87b6c6a46926c5b022bd7588e3187

Analysis

max time kernel
170s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:28

Target

a6a5f092920850619f20649918e0e20394d87b6c6a46926c5b022bd7588e3187.dll
Size

444KB
MD5

ca9852461a4560709b711105d6d0ed13
SHA1

69cf0ebb7e11285d1128fd0286571d9daf91155d
SHA256

a6a5f092920850619f20649918e0e20394d87b6c6a46926c5b022bd7588e3187
SHA512

71ec1394a1b6473c806b299b1a356401023975289de2f09798852d1596b3699f9ec205698210f5943fad73ae779b08603620a02e00a0fb59903d4b50adb38a93
SSDEEP

12288://ZBdPL2DVt5VOmKoluG0NyeqLNuYyrVcs://ZriDVtZq/8uFrL

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2608 1232 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2608	1232	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3572 wrote to memory of 1232	3572	rundll32.exe	rundll32.exe
PID 3572 wrote to memory of 1232	3572	rundll32.exe	rundll32.exe
PID 3572 wrote to memory of 1232	3572	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a6a5f092920850619f20649918e0e20394d87b6c6a46926c5b022bd7588e3187.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3572

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a6a5f092920850619f20649918e0e20394d87b6c6a46926c5b022bd7588e3187.dll,#1
2⤵
PID:1232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 612
3⤵
- Program crash
PID:2608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1232 -ip 1232
1⤵
PID:1648