d3197dd9aec8f204f12ac85207ee1df2a6693b6c217a3d74ccbcb3098916ebe6

Resubmissions

24-11-2022 15:37

24-11-2022 10:52

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 15:37

Target

d3197dd9aec8f204f12ac85207ee1df2a6693b6c217a3d74ccbcb3098916ebe6.dll
Size

60KB
MD5

3c4bd5309143853848381c9eb0435d75
SHA1

ebc1cbd8e5ceaff0dd941fd044d106997eba846f
SHA256

d3197dd9aec8f204f12ac85207ee1df2a6693b6c217a3d74ccbcb3098916ebe6
SHA512

2455a862cfd69f7879d869de2aad43797aa81ff10cd9e81b11705185b2517d4b751871c096568714c48aca25bbf1b414b66ef7f82eb8fa35ee458d511c3c543e
SSDEEP

768:Uc6gRL3cpsKBRkdeVyg7ifaU1rz9oDc0kT2w3P5WKpQlORX7UmZ:UlaL3cpnR1ApLCDcz3PNBRX73

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1428 1100 WerFault.exe rundll32.exe
4872 1100 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1428	1100	WerFault.exe	rundll32.exe
4872	1100	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4464 wrote to memory of 1100	4464	rundll32.exe	rundll32.exe
PID 4464 wrote to memory of 1100	4464	rundll32.exe	rundll32.exe
PID 4464 wrote to memory of 1100	4464	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3197dd9aec8f204f12ac85207ee1df2a6693b6c217a3d74ccbcb3098916ebe6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3197dd9aec8f204f12ac85207ee1df2a6693b6c217a3d74ccbcb3098916ebe6.dll,#1
  2⤵
  PID:1100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 588
    3⤵
    - Program crash
    PID:1428
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 848
    3⤵
    - Program crash
    PID:4872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1100 -ip 1100
1⤵
PID:5088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1100 -ip 1100
1⤵
PID:1052