3ee6adf4f5a790b42fac892477c80aa713d0df3016f2cfb9631d7b9f935ccae1

Analysis

max time kernel
141s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:31

Target

3ee6adf4f5a790b42fac892477c80aa713d0df3016f2cfb9631d7b9f935ccae1.dll
Size

88KB
MD5

5d73418c5e62214d4aa3dadf66f7ec1b
SHA1

499f3aa849a2ad07860ae20e168d5b8d1bc37a87
SHA256

3ee6adf4f5a790b42fac892477c80aa713d0df3016f2cfb9631d7b9f935ccae1
SHA512

66f5e7af6badc4da343f54886625a0ca480eb73636059255fd59fe97520e7f327e6aea72a7e87e9cec72ad196c2ae6de476bc79e9766916e691a73d4663c8a4a
SSDEEP

1536:25GGE6ySbQXI8MU12fuDKrsA7KWpb5wmDPSQVMS7NyGWulv:256JS80mpIyCM4Ui

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1532 1964 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1532	1964	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2564 wrote to memory of 1964	2564	rundll32.exe	rundll32.exe
PID 2564 wrote to memory of 1964	2564	rundll32.exe	rundll32.exe
PID 2564 wrote to memory of 1964	2564	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ee6adf4f5a790b42fac892477c80aa713d0df3016f2cfb9631d7b9f935ccae1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2564

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ee6adf4f5a790b42fac892477c80aa713d0df3016f2cfb9631d7b9f935ccae1.dll,#1
2⤵
PID:1964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 616
3⤵
- Program crash
PID:1532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1964 -ip 1964
1⤵
PID:2804