83ba8419c25cfce67f5b41d27f449864fcb89a557e4c71925b63aa05dc279ba8

Analysis

max time kernel
205s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 06:43

Target

83ba8419c25cfce67f5b41d27f449864fcb89a557e4c71925b63aa05dc279ba8.dll
Size

32KB
MD5

7f6f2b7656c69b7587539f33e37e2280
SHA1

9d9bcfaa5ec2ef2e854a8c044397c2c146b6a6b8
SHA256

83ba8419c25cfce67f5b41d27f449864fcb89a557e4c71925b63aa05dc279ba8
SHA512

6ea5535c2343332c9bb176db41eae9cc1ceff479ee2ff841a15534568eb8684941d043089a8c1f8614cb20cdfc0339a8645525ddb820ae279c1b686597c8cb20
SSDEEP

384:i/pJuzg3dzNCo5Gi2a5V1dZgeQqghAEc9F+tnu6EDHJIg1/NC3vU2ZEq8A2L9U:iLu85nZd+e/gh0OnTEDo3vUsCU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1352	4748	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3636 wrote to memory of 4748	3636	rundll32.exe	80
PID 3636 wrote to memory of 4748	3636	rundll32.exe	80
PID 3636 wrote to memory of 4748	3636	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\83ba8419c25cfce67f5b41d27f449864fcb89a557e4c71925b63aa05dc279ba8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\83ba8419c25cfce67f5b41d27f449864fcb89a557e4c71925b63aa05dc279ba8.dll,#1
  2⤵
  PID:4748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 600
    3⤵
    - Program crash
    PID:1352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4748 -ip 4748
1⤵
PID:4376