84bf45af5a15adc9a4fc44ba6a39424410c5ab232e87e65a852687ae0e4546c3

Analysis

max time kernel
91s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 06:36

Target

84bf45af5a15adc9a4fc44ba6a39424410c5ab232e87e65a852687ae0e4546c3.dll
Size

19KB
MD5

98e92ec7728d6660abd6c53742546f01
SHA1

9b26224d65637da50802a4f76ecabe0821c1980a
SHA256

84bf45af5a15adc9a4fc44ba6a39424410c5ab232e87e65a852687ae0e4546c3
SHA512

5f70d56dc91dde0507451f956fdec839a6276a7521bced3c1da434b1364864c424c9310b5e3e588bd091c9e35172fbe4f5df4d20e8d7ff540e59c2192d8dcf09
SSDEEP

192:6NcOEzFXCnKz+IKnGWO1f0aoR7x+sBWtn9NyBOC092cKfjcR0BcPG6s1bT:6NMzQjHnG/oRlTY5tC0ocEjU0Bcts1T

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2960 5044 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2960	5044	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4180 wrote to memory of 5044	4180	rundll32.exe	rundll32.exe
PID 4180 wrote to memory of 5044	4180	rundll32.exe	rundll32.exe
PID 4180 wrote to memory of 5044	4180	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\84bf45af5a15adc9a4fc44ba6a39424410c5ab232e87e65a852687ae0e4546c3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4180

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\84bf45af5a15adc9a4fc44ba6a39424410c5ab232e87e65a852687ae0e4546c3.dll,#1
2⤵
PID:5044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 624
3⤵
- Program crash
PID:2960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 5044 -ip 5044
1⤵
PID:2164