a0d914246e74db23a7c007cfde28173a8fbc251e8eb6202bd463c35f05239bb7

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 07:38

Target

a0d914246e74db23a7c007cfde28173a8fbc251e8eb6202bd463c35f05239bb7.dll
Size

169KB
MD5

12e85d0ddc6a784b5f915054ebe072a5
SHA1

cb23a3b6e88eca769ce80ef10874392ff0a1e6fb
SHA256

a0d914246e74db23a7c007cfde28173a8fbc251e8eb6202bd463c35f05239bb7
SHA512

b30bed5ea980be8e52b0b45f3703ad3a0d7f061205fffad617ee862e948e8cf05edb1b4692f653a5e544a7f9d9ece404eea00c7b2ab209ba7c13819f82f53835
SSDEEP

3072:vuhE6zRkEwBGwRA72tVDtv7gPFB0rjmqyVDmJFd+cYqMTrLS7:vuhPwB+72tptvUv0rKqyJ5xG7

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1196 4808 WerFault.exe rundll32.exe
3520 4808 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1196	4808	WerFault.exe	rundll32.exe
3520	4808	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2692 wrote to memory of 4808	2692	rundll32.exe	rundll32.exe
PID 2692 wrote to memory of 4808	2692	rundll32.exe	rundll32.exe
PID 2692 wrote to memory of 4808	2692	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a0d914246e74db23a7c007cfde28173a8fbc251e8eb6202bd463c35f05239bb7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a0d914246e74db23a7c007cfde28173a8fbc251e8eb6202bd463c35f05239bb7.dll,#1
  2⤵
  PID:4808
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 544
    3⤵
    - Program crash
    PID:1196
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 824
    3⤵
    - Program crash
    PID:3520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4808 -ip 4808
1⤵
PID:876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4808 -ip 4808
1⤵
PID:1364