a9915cd3f8852f70147824ce5bbb7bfaa53d1c97d2e908e9565bb000bab6d4cc

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 03:37

Target

a9915cd3f8852f70147824ce5bbb7bfaa53d1c97d2e908e9565bb000bab6d4cc.dll
Size

236KB
MD5

9234ac7786abe337a2feb56ce7d6b7f8
SHA1

ca6458879d9084d15864df179a794fd824414a57
SHA256

a9915cd3f8852f70147824ce5bbb7bfaa53d1c97d2e908e9565bb000bab6d4cc
SHA512

275b9634292d81712a562f3beef9fe158efb1e99cc47780feb8286737c9481c4842d8b121e936d6bb9549b658153d80204af92e1a169ea70f79b732d675ecd61
SSDEEP

3072:Olsq5sd1QeEWuffjReT2sx0SEE95j/KkW/Q4tJerCxB75Ebe8N2Hq/MXeYn3nXnX:S4d1qFKHz6kCL7558N1c6y

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3832	1996	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 1996	2412	rundll32.exe	79
PID 2412 wrote to memory of 1996	2412	rundll32.exe	79
PID 2412 wrote to memory of 1996	2412	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9915cd3f8852f70147824ce5bbb7bfaa53d1c97d2e908e9565bb000bab6d4cc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9915cd3f8852f70147824ce5bbb7bfaa53d1c97d2e908e9565bb000bab6d4cc.dll,#1
  2⤵
  PID:1996
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 636
    3⤵
    - Program crash
    PID:3832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1996 -ip 1996
1⤵
PID:3724