5d0bb8e0971bf4369ecc70dda0436b4b937fb3f376c47c4cb4722916c928fe30

Analysis

max time kernel
91s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:12

Target

5d0bb8e0971bf4369ecc70dda0436b4b937fb3f376c47c4cb4722916c928fe30.dll
Size

444KB
MD5

b50a8d6647f06fbf72d87d0ef66e91fa
SHA1

c500edaeb4cefdabc2ba5072d76fd2ef81c54d70
SHA256

5d0bb8e0971bf4369ecc70dda0436b4b937fb3f376c47c4cb4722916c928fe30
SHA512

813447363b8d6893b191a53effa857310d819160de614748e4a8ed31b6435e4e745d40d6737c8f0296baede004e7f4d4e632114d0fb885af495b657134f49990
SSDEEP

6144:mwLbpOeCl8Mc0xq+7/PIzfem/9UD1BHFrkAJH+oZKNYbZn/fyjEB11odUzd:mwEYWq+rttDHDVDiqmeadUz

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1804 1316 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1804	1316	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1772 wrote to memory of 1316	1772	rundll32.exe	rundll32.exe
PID 1772 wrote to memory of 1316	1772	rundll32.exe	rundll32.exe
PID 1772 wrote to memory of 1316	1772	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5d0bb8e0971bf4369ecc70dda0436b4b937fb3f376c47c4cb4722916c928fe30.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5d0bb8e0971bf4369ecc70dda0436b4b937fb3f376c47c4cb4722916c928fe30.dll,#1
  2⤵
  PID:1316
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 612
    3⤵
    - Program crash
    PID:1804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1316 -ip 1316
1⤵
PID:1292