a36b0b3703928f46c9f648910eeff253aa6fa702614e173e05b95d902416d8d2

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 22:24

Target

a36b0b3703928f46c9f648910eeff253aa6fa702614e173e05b95d902416d8d2.dll
Size

97KB
MD5

040aae2e851338bdce796420914e928a
SHA1

97600fbd2fec878923a722bc054e3e4803127f8f
SHA256

a36b0b3703928f46c9f648910eeff253aa6fa702614e173e05b95d902416d8d2
SHA512

ca63da2e759f5c7c2cf17619131b2e26a8cadbede291005546634593aaa16baefec302e4586c232e9f550e1ae4a2d1b2e8ffe1e98f4ade7d49ea59c1e4c6c82c
SSDEEP

1536:wkxaf6YvvCiBAR66FIU66zKZyUqRWnLwNPoAyqyuy5d98xCUzan1SKmHI:woYO66FxeUHWAyJ5daxCUzK1SKT

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

856 4208 WerFault.exe rundll32.exe

pid	pid_target	process	target process
856	4208	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3068 wrote to memory of 4208	3068	rundll32.exe	rundll32.exe
PID 3068 wrote to memory of 4208	3068	rundll32.exe	rundll32.exe
PID 3068 wrote to memory of 4208	3068	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a36b0b3703928f46c9f648910eeff253aa6fa702614e173e05b95d902416d8d2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3068

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a36b0b3703928f46c9f648910eeff253aa6fa702614e173e05b95d902416d8d2.dll,#1
2⤵
PID:4208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4208 -s 608
3⤵
- Program crash
PID:856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4208 -ip 4208
1⤵
PID:3984