ac57139ef9e808b608ebb12d734c780fde93f62ae9506efde298c188556d9eb1

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2022, 18:43

Target

ac57139ef9e808b608ebb12d734c780fde93f62ae9506efde298c188556d9eb1.dll
Size

20KB
MD5

588a77331720c5e23461b418daa0871f
SHA1

65349cecdfdb40d3b13f86bd138e2379e637e681
SHA256

ac57139ef9e808b608ebb12d734c780fde93f62ae9506efde298c188556d9eb1
SHA512

8dabcbc9e8d5988dda7cb9ab9e9d9aca8a800af3ba3653e865c5866d4e7e37423bd2f7b85079b6499cea3ca1de2007895341f28c0367f68fd90167be22507b9a
SSDEEP

384:zSG/2Jp+C6QhtmruxCcdIL+0XplrCAu8UaWHuqaTlX0wG:zfYh2oCtpXPrx2OqaewG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1440	5092	WerFault.exe	79

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 5092	2424	rundll32.exe	79
PID 2424 wrote to memory of 5092	2424	rundll32.exe	79
PID 2424 wrote to memory of 5092	2424	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac57139ef9e808b608ebb12d734c780fde93f62ae9506efde298c188556d9eb1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac57139ef9e808b608ebb12d734c780fde93f62ae9506efde298c188556d9eb1.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 624
    3⤵
    - Program crash
    PID:1440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5092 -ip 5092
1⤵
PID:552