4d4a1a23c24cee9001a5a6664d7bf2a79d3b45205643bbce5ede2a50fda16c37

Analysis

max time kernel
169s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2022, 19:26

Target

4d4a1a23c24cee9001a5a6664d7bf2a79d3b45205643bbce5ede2a50fda16c37.dll
Size

107KB
MD5

6dab3a9f452dce71e0d557118753b8fe
SHA1

97b890f01e8b4be01d6445d59c31b6e3570d455c
SHA256

4d4a1a23c24cee9001a5a6664d7bf2a79d3b45205643bbce5ede2a50fda16c37
SHA512

3fa0a596bb68d761804a093e8878481893645681aeb7935b552035264de1cbad5bea8352118ccb6012eb9ad47c03dbd427b3d5f9236c6a2491021a33fd472394
SSDEEP

1536:cxzEOBCPtQiYVH7lAdy2EixSNdMPP26k9Zn+dzSeQCRz9Wp:cJUbSwR0uP2qmeQCRz9W

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1268	1340	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 1340	2656	rundll32.exe	82
PID 2656 wrote to memory of 1340	2656	rundll32.exe	82
PID 2656 wrote to memory of 1340	2656	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d4a1a23c24cee9001a5a6664d7bf2a79d3b45205643bbce5ede2a50fda16c37.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d4a1a23c24cee9001a5a6664d7bf2a79d3b45205643bbce5ede2a50fda16c37.dll,#1
  2⤵
  PID:1340
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 640
    3⤵
    - Program crash
    PID:1268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1340 -ip 1340
1⤵
PID:1944