2f663b37afcb10bb6e6a16bccd8beb914bab3e3271d3a9c0b72e52c270fdd03b

Analysis

max time kernel
158s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 18:53

Target

2f663b37afcb10bb6e6a16bccd8beb914bab3e3271d3a9c0b72e52c270fdd03b.dll
Size

130KB
MD5

43e1f6ffc5cb49345678bcc460876ba0
SHA1

bdee4fb7f6ae57558adccc54b2e600164e95cc3f
SHA256

2f663b37afcb10bb6e6a16bccd8beb914bab3e3271d3a9c0b72e52c270fdd03b
SHA512

7a0b6a46f3f271a8233b40ab1a4aca0250c12ab6b249e7c6a08e7433d4b6b168e119e05cbbcd97fa1f5abb0d0f96858dd948e5b345d6eee18b48a4f85ae63012
SSDEEP

3072:KjpG5EqwYpkUagFqiagA2DMNvuScvONpPmIYhJLo1s3dKxC5RyPu9ahCgsVZuBiL:KjpG5EqwYpkUagFqNgA2DMNvuScvONpw

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1692 2352 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1692	2352	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1540 wrote to memory of 2352	1540	rundll32.exe	rundll32.exe
PID 1540 wrote to memory of 2352	1540	rundll32.exe	rundll32.exe
PID 1540 wrote to memory of 2352	1540	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f663b37afcb10bb6e6a16bccd8beb914bab3e3271d3a9c0b72e52c270fdd03b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1540

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f663b37afcb10bb6e6a16bccd8beb914bab3e3271d3a9c0b72e52c270fdd03b.dll,#1
2⤵
PID:2352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 584
3⤵
- Program crash
PID:1692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2352 -ip 2352
1⤵
PID:1316