3534f12fed91ca8377ff9b2b658301d0b5916e4d27a3959f2066d52dd3ab2f4b

Analysis

max time kernel
164s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 19:53

Target

3534f12fed91ca8377ff9b2b658301d0b5916e4d27a3959f2066d52dd3ab2f4b.dll
Size

37KB
MD5

a8ca459be11daf988272ac5c26cf1d7c
SHA1

7d859138321dc206db3cb110b3d082ba7541abda
SHA256

3534f12fed91ca8377ff9b2b658301d0b5916e4d27a3959f2066d52dd3ab2f4b
SHA512

2181dcf09c944065f495ac8761374f31e079d54be2cca90b43be7f359d5b4cc7f805b20eb067891dd1096e2fefeef512bd7fe78e11bf1edb529cb9971348bfcf
SSDEEP

768:6iLj7ADRiYLbpV8xHv+ouGSV2XLyYhlPVHObJgu9TJ4:PHHYLr8mPGnLZFu2u9TJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
632	220	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 204 wrote to memory of 220	204	rundll32.exe	84
PID 204 wrote to memory of 220	204	rundll32.exe	84
PID 204 wrote to memory of 220	204	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3534f12fed91ca8377ff9b2b658301d0b5916e4d27a3959f2066d52dd3ab2f4b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3534f12fed91ca8377ff9b2b658301d0b5916e4d27a3959f2066d52dd3ab2f4b.dll,#1
  2⤵
  PID:220
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 600
    3⤵
    - Program crash
    PID:632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 220 -ip 220
1⤵
PID:2976