60555b6cd2a8d40fc3cac94677ca754828400e4d2171f1deea2dd7aad36cfa72

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:10

Target

60555b6cd2a8d40fc3cac94677ca754828400e4d2171f1deea2dd7aad36cfa72.dll
Size

380KB
MD5

360407b1a91bb260b29a182ebbf74ebd
SHA1

e93038fc60843d7cbef81e68a17aa64612f5e22f
SHA256

60555b6cd2a8d40fc3cac94677ca754828400e4d2171f1deea2dd7aad36cfa72
SHA512

c87cffdffa8674dc095e2e16aa10d79a146c8885d7cfeaf04c712724822e11e2f144e310f26c4fee4c5b9576769a24c2f06f6ea8785e7f8c6e6ca272b9486cd2
SSDEEP

6144:Fs7mHiUNIxGrfrDIQBk2TES1Fh/pAYlJGkLaZvpSn9iGmchd7F9mwdTh4XQ:FssHNkGrfQR2TESDh1JEhpm9iGmchdxf

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4904 5024 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4904	5024	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5060 wrote to memory of 5024	5060	rundll32.exe	rundll32.exe
PID 5060 wrote to memory of 5024	5060	rundll32.exe	rundll32.exe
PID 5060 wrote to memory of 5024	5060	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\60555b6cd2a8d40fc3cac94677ca754828400e4d2171f1deea2dd7aad36cfa72.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5060

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\60555b6cd2a8d40fc3cac94677ca754828400e4d2171f1deea2dd7aad36cfa72.dll,#1
2⤵
PID:5024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 580
3⤵
- Program crash
PID:4904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 5024 -ip 5024
1⤵
PID:5016