9d8815c5e369449e5c5cd5a9bb012144fba3f428e4b00bb604e34c926c23c69a

Analysis

max time kernel
209s
max time network
222s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 04:33

Target

9d8815c5e369449e5c5cd5a9bb012144fba3f428e4b00bb604e34c926c23c69a.dll
Size

42KB
MD5

7cecb20114c734547837e154b64f9c61
SHA1

32a9ef3a73d78e309b86abda6f586a8d109814ad
SHA256

9d8815c5e369449e5c5cd5a9bb012144fba3f428e4b00bb604e34c926c23c69a
SHA512

10618c6b9d27242af10aad06aa04c57daa81bce12ee8287bd9a131b09bcdf64c0c43461f809e8a0530a303233d388bcf4239e97293043ea601bbdc56d00220be
SSDEEP

768:aiUDk5T0KN7C1wSgFOs8EygXMuEqtvglUxkU5Xpo973J:axk5T0KN21wSPsxXZEqdT5oVZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3432	1688	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 1688	1392	rundll32.exe	81
PID 1392 wrote to memory of 1688	1392	rundll32.exe	81
PID 1392 wrote to memory of 1688	1392	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9d8815c5e369449e5c5cd5a9bb012144fba3f428e4b00bb604e34c926c23c69a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9d8815c5e369449e5c5cd5a9bb012144fba3f428e4b00bb604e34c926c23c69a.dll,#1
  2⤵
  PID:1688
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 572
    3⤵
    - Program crash
    PID:3432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1688 -ip 1688
1⤵
PID:1988