8483a38e9673555f2501ed52a1901172a56e5b6c97717d449a2273b43e99789f

Analysis

max time kernel
91s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 06:38

Target

8483a38e9673555f2501ed52a1901172a56e5b6c97717d449a2273b43e99789f.dll
Size

471KB
MD5

4e8efbd724d88d46111405f736cd08b8
SHA1

8762958cc5b93648b0f071d7db1bf49836092ee8
SHA256

8483a38e9673555f2501ed52a1901172a56e5b6c97717d449a2273b43e99789f
SHA512

2cdf274d39312035e298ee5b1cee07a047c1ea09870b51997d4d17f8841da55108eab41a6df09f24d4f1af3bd29cb46cd93de9ec2b0aef1c52c048ec13b5a75b
SSDEEP

6144:AduB59NSJnZQ2/Ur/xXotgmTpjKgJLuyDedvwk+OiEQ135wOw2tXw+lCFtEL+57E:PNSNZQ2/WhiJrJEhMXw+lRAe6AT5hB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4800	648	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 648	2804	rundll32.exe	82
PID 2804 wrote to memory of 648	2804	rundll32.exe	82
PID 2804 wrote to memory of 648	2804	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8483a38e9673555f2501ed52a1901172a56e5b6c97717d449a2273b43e99789f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8483a38e9673555f2501ed52a1901172a56e5b6c97717d449a2273b43e99789f.dll,#1
  2⤵
  PID:648
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 576
    3⤵
    - Program crash
    PID:4800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 648 -ip 648
1⤵
PID:812