5fd0d34ddbf474d76e63f0fbc172ed58c05580d1ac6d6c087d99032be950b482

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 20:37

Target

5fd0d34ddbf474d76e63f0fbc172ed58c05580d1ac6d6c087d99032be950b482.dll
Size

6KB
MD5

6eda56c9d91ff45e7fd762a319ef3722
SHA1

079eaec9e5fd68e6b0333e45345b2b2988e887fe
SHA256

5fd0d34ddbf474d76e63f0fbc172ed58c05580d1ac6d6c087d99032be950b482
SHA512

b0c68456ecef927f557bf830a5a7400777191e37c702496393c2b4bfc645bd81fb5b9e68c8a95fa60ab16abafeb6fc98ff79a658e166f376cbad9b39ad385190
SSDEEP

96:MA/wSmnN36uqXlSuyKyZsl46AWUZXfMWGyG5St14g8JHz2WRyfL4PA/wSmhZklI/:GCpVluKZU+uGHg8JT2W0fL4xbHQA

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3668 5064 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3668	5064	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5000 wrote to memory of 5064	5000	rundll32.exe	rundll32.exe
PID 5000 wrote to memory of 5064	5000	rundll32.exe	rundll32.exe
PID 5000 wrote to memory of 5064	5000	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5fd0d34ddbf474d76e63f0fbc172ed58c05580d1ac6d6c087d99032be950b482.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5000

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5fd0d34ddbf474d76e63f0fbc172ed58c05580d1ac6d6c087d99032be950b482.dll,#1
2⤵
PID:5064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 600
3⤵
- Program crash
PID:3668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5064 -ip 5064
1⤵
PID:1840