3753f687a7dddbc4e0d2571971634ad90e9dac5909e559bbcbdd67e20b3808d9

Analysis

max time kernel
245s
max time network
316s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 05:10

Target

3753f687a7dddbc4e0d2571971634ad90e9dac5909e559bbcbdd67e20b3808d9.dll
Size

461KB
MD5

f02a72a077b8ff624053bc6c7b0782b6
SHA1

11828e2b7780e808f2b1a07350c0c149b19005be
SHA256

3753f687a7dddbc4e0d2571971634ad90e9dac5909e559bbcbdd67e20b3808d9
SHA512

a7973c4d2b44554ccdb6d5cf4ac771b40386e4f8e6c0ffc1c3b3981f4bc7a944c4447503d14850f6421c409bca916db9ecb3e123bb07e23d2d3da5f2ea7c0c24
SSDEEP

12288:xmZZ3jCZwus8D0UC3mlCVyU2f2sPuYnsbISu7h:Y2Z6UYmluumYnsM1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4128	2180	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 2180	952	rundll32.exe	81
PID 952 wrote to memory of 2180	952	rundll32.exe	81
PID 952 wrote to memory of 2180	952	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3753f687a7dddbc4e0d2571971634ad90e9dac5909e559bbcbdd67e20b3808d9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3753f687a7dddbc4e0d2571971634ad90e9dac5909e559bbcbdd67e20b3808d9.dll,#1
  2⤵
  PID:2180
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 888
    3⤵
    - Program crash
    PID:4128