ab8a9df5524a07c4d4a7d3cdf5335e13ff2faee6e96c2412c8e632cdae751fea

Analysis

max time kernel
216s
max time network
267s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 18:48

Target

ab8a9df5524a07c4d4a7d3cdf5335e13ff2faee6e96c2412c8e632cdae751fea.dll
Size

20KB
MD5

42da8fd934c0b32c90e71175ca45caf4
SHA1

07fcaee505a450e43a902f8cd03e8b1e0c479571
SHA256

ab8a9df5524a07c4d4a7d3cdf5335e13ff2faee6e96c2412c8e632cdae751fea
SHA512

0e7ca070272dd1cab5ecc9238b7a6a75a06f15ff7e530ffc2f9513fa3ba87690a4d4075deb85a2818389bd35b08192176f4e1e473b511d163807de0c700fd68a
SSDEEP

384:zSG/2Jp+C6QhtmruxCcdIL+0XplPCAu8UaWHuqaTlX0wG:zfYh2oCtpXPPx2OqaewG

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2264 4436 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

4436 rundll32.exe
4436 rundll32.exe

pid	pid_target	process	target process
2264	4436	WerFault.exe	rundll32.exe

pid	process
4436	rundll32.exe
4436	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3496 wrote to memory of 4436	3496	rundll32.exe	rundll32.exe
PID 3496 wrote to memory of 4436	3496	rundll32.exe	rundll32.exe
PID 3496 wrote to memory of 4436	3496	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab8a9df5524a07c4d4a7d3cdf5335e13ff2faee6e96c2412c8e632cdae751fea.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3496

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab8a9df5524a07c4d4a7d3cdf5335e13ff2faee6e96c2412c8e632cdae751fea.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 628
3⤵
- Program crash
PID:2264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4436 -ip 4436
1⤵
PID:380