6da7ddbd7007d59112794b2829fee34f6c1edfa23ff604f1b7e02fb260be9c1e

Analysis

max time kernel
83s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 09:54

Target

6da7ddbd7007d59112794b2829fee34f6c1edfa23ff604f1b7e02fb260be9c1e.dll
Size

31KB
MD5

6da6ddc96ef4146a9f9dbadda78228d9
SHA1

ed0828aedb13ee00ed8d7354554462facaad060b
SHA256

6da7ddbd7007d59112794b2829fee34f6c1edfa23ff604f1b7e02fb260be9c1e
SHA512

9a0076adb23132402b59f0b9e8779c8c03bc2ed3fe48e10691df26d4905039eb4ad6ee224b9c22971d1a8397e157eec24d7dafd058eb0a9ed4593a7b7f6447a0
SSDEEP

192:sSNckBnqi46trQt5JO/uRyVUhfDIdvKinYe+PjPHrozBmF8+v8LjtlAur9ZCspEv:Dz46BQROyDfDISinYPLi8AHUHeMG3sL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
360	3828	WerFault.exe	76

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4424 wrote to memory of 3828	4424	rundll32.exe	76
PID 4424 wrote to memory of 3828	4424	rundll32.exe	76
PID 4424 wrote to memory of 3828	4424	rundll32.exe	76

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6da7ddbd7007d59112794b2829fee34f6c1edfa23ff604f1b7e02fb260be9c1e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6da7ddbd7007d59112794b2829fee34f6c1edfa23ff604f1b7e02fb260be9c1e.dll,#1
  2⤵
  PID:3828
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 608
    3⤵
    - Program crash
    PID:360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3828 -ip 3828
1⤵
PID:2116