385a90af7d22dfb3f68ed92230a9485bf367f8e6da2d1059d5c8f971fb1d2480

Analysis

max time kernel
149s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:34

Target

385a90af7d22dfb3f68ed92230a9485bf367f8e6da2d1059d5c8f971fb1d2480.dll
Size

241KB
MD5

69edba8e140f4efb1fcad888782adbe7
SHA1

59e187d03f59694a810d34469f09317e06317979
SHA256

385a90af7d22dfb3f68ed92230a9485bf367f8e6da2d1059d5c8f971fb1d2480
SHA512

6f3c18fcdbcf9b341666a1468088715ed007329a62172c1a3249914b3bede6bd327ba6d7592978bf22cd951934468ad7b32680c8f7f9430754c740d5aae77967
SSDEEP

6144:hrUCgh5WfB+Q7lQwMhxEnV3pjwtpDr/2MUIV8UmXA:ZUIyEV5CJTVzB

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3804 4564 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3804	4564	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2028 wrote to memory of 4564	2028	rundll32.exe	rundll32.exe
PID 2028 wrote to memory of 4564	2028	rundll32.exe	rundll32.exe
PID 2028 wrote to memory of 4564	2028	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\385a90af7d22dfb3f68ed92230a9485bf367f8e6da2d1059d5c8f971fb1d2480.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\385a90af7d22dfb3f68ed92230a9485bf367f8e6da2d1059d5c8f971fb1d2480.dll,#1
2⤵
PID:4564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 580
3⤵
- Program crash
PID:3804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4564 -ip 4564
1⤵
PID:4988