cc206678c5c43b699f57048b992de42118f8c750e88d48ad2d6014e0b5b1c03b

Analysis

max time kernel
153s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 22:47

Target

cc206678c5c43b699f57048b992de42118f8c750e88d48ad2d6014e0b5b1c03b.dll
Size

144KB
MD5

791b561958cad0eceb4ff010c383d0b3
SHA1

70b299e720293638c24309a5c9c3a09c3e55dfda
SHA256

cc206678c5c43b699f57048b992de42118f8c750e88d48ad2d6014e0b5b1c03b
SHA512

a268517452493979762795841ab4b0838f9d6fd6402978698c12dd7a386d24ebf11d3758091cd95718a79735b59b074952a86f79e8c44dc5bedcbd4b2243ce69
SSDEEP

3072:mxW8Dr5Dkyq6SPTZunOoyWyY9pm/WQNK:b8hk6SPTqXyWyCL

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5060	4844	WerFault.exe	78
1952	4844	WerFault.exe	78

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 5060	4844	rundll32.exe	81
PID 4844 wrote to memory of 5060	4844	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cc206678c5c43b699f57048b992de42118f8c750e88d48ad2d6014e0b5b1c03b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4844 -s 376
  2⤵
  - Program crash
  PID:5060
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4844 -s 376
  2⤵
  - Program crash
  PID:1952

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 432 -p 4844 -ip 4844
1⤵
PID:2240