6436f04f508b2c3940c9efd556755880845312025fa0079b5019661bb8c03f6c

Analysis

max time kernel
92s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 02:49

Target

6436f04f508b2c3940c9efd556755880845312025fa0079b5019661bb8c03f6c.dll
Size

28KB
MD5

2243e6d6652c06f40bd002128c35a957
SHA1

0029a797d363656ced0b0ead36baf00b2241c01f
SHA256

6436f04f508b2c3940c9efd556755880845312025fa0079b5019661bb8c03f6c
SHA512

0f08874eb2ec6c6544620c465e7b84a16812c8de93159df5b413afa9d3921b9f6c7dceb580fe4c76fc4500b1956e4504b0a46b64b98bc1ba13540cf545be384e
SSDEEP

192:1UDNYUwVUpkZwgWumGjUNUF4v91tQtKqpqSqq5kfQ2wqpqSqqcE:12YUOhaOU+y91tQt5ASZ5kfQ2jASZcE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
772	3372	WerFault.exe	76

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 3372	4432	rundll32.exe	76
PID 4432 wrote to memory of 3372	4432	rundll32.exe	76
PID 4432 wrote to memory of 3372	4432	rundll32.exe	76

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6436f04f508b2c3940c9efd556755880845312025fa0079b5019661bb8c03f6c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6436f04f508b2c3940c9efd556755880845312025fa0079b5019661bb8c03f6c.dll,#1
  2⤵
  PID:3372
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3372 -s 628
    3⤵
    - Program crash
    PID:772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3372 -ip 3372
1⤵
PID:1848