922498fe35a8813290d4e5ce3ffe878e6f4eb1ececdc5257a1960a2014cb828d

Analysis

max time kernel
139s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 05:22

Target

922498fe35a8813290d4e5ce3ffe878e6f4eb1ececdc5257a1960a2014cb828d.dll
Size

168KB
MD5

751b89cdc32a2e12beb489ecab92671c
SHA1

5ec072c58a73233a73e0253a4cbee7fbc16c3678
SHA256

922498fe35a8813290d4e5ce3ffe878e6f4eb1ececdc5257a1960a2014cb828d
SHA512

ec092e0ad099d091750dcc0491f5d291674bd8f598f315f0f3c988e93db84d2008f6b6b2de85c16c9d0db8d9ffb18a36b031c30896436dd26c562439edeef8d6
SSDEEP

3072:R7TE5vo+hA7CAbp+vsMYNvHBBxG4/F/XNu3VLVZSZpbQokYJizB4yQ:Mo+u7p9hNrxG4hXkpSZCB94

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1960	3704	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 3704	4308	rundll32.exe	80
PID 4308 wrote to memory of 3704	4308	rundll32.exe	80
PID 4308 wrote to memory of 3704	4308	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\922498fe35a8813290d4e5ce3ffe878e6f4eb1ececdc5257a1960a2014cb828d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\922498fe35a8813290d4e5ce3ffe878e6f4eb1ececdc5257a1960a2014cb828d.dll,#1
  2⤵
  PID:3704
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 604
    3⤵
    - Program crash
    PID:1960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 3704 -ip 3704
1⤵
PID:4580