ee2600669ccccf262b93da1a4f0525a51d0a8855b9032aa9ae3eeb0ff76f82e3

Analysis

max time kernel
159s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 19:37

Target

ee2600669ccccf262b93da1a4f0525a51d0a8855b9032aa9ae3eeb0ff76f82e3.dll
Size

426KB
MD5

0fd02a843297d08c69a8c24ca15ee8d1
SHA1

00cdf1d8a95bda61498cb8034cdcd60729ff2be3
SHA256

ee2600669ccccf262b93da1a4f0525a51d0a8855b9032aa9ae3eeb0ff76f82e3
SHA512

2fb4ef025fdbd7e1372028896805158828d38c39baee510c4e1e98500adae61d2f85212b53590a7e4370a139c7c7e619b8ca1e3ab1120528aff84797ad3a49fd
SSDEEP

12288:uL4dM7slGplnA+0/ULDFCGf4NGxapwJZMhFg:Gv9l90MLDoi4NGxxJqFg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4436	3868	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 3868	1052	rundll32.exe	80
PID 1052 wrote to memory of 3868	1052	rundll32.exe	80
PID 1052 wrote to memory of 3868	1052	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ee2600669ccccf262b93da1a4f0525a51d0a8855b9032aa9ae3eeb0ff76f82e3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ee2600669ccccf262b93da1a4f0525a51d0a8855b9032aa9ae3eeb0ff76f82e3.dll,#1
  2⤵
  PID:3868
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 588
    3⤵
    - Program crash
    PID:4436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3868 -ip 3868
1⤵
PID:1240