77aab0c0bc4bb4da132f40efea403e1afb5535b9668bd8c7e39fe767ed5669d7

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 07:31

Target

77aab0c0bc4bb4da132f40efea403e1afb5535b9668bd8c7e39fe767ed5669d7.dll
Size

457KB
MD5

db9e6315b12a712a7bf1fd5654d3b5c0
SHA1

09eea6629ec990dac78a17eed9940a52bfe8dfdd
SHA256

77aab0c0bc4bb4da132f40efea403e1afb5535b9668bd8c7e39fe767ed5669d7
SHA512

bd26a1d29a2698b863bd549b5a13cff0c7891332632b3747c4e66c725dccc9ae0b3f8847d69b4776e14f83b87b7c5225d4c72ed456348dc808cc0b97e7a1faa4
SSDEEP

12288:+1WD7iuq9WarATQBjI5CWfZfsDa4QItOhKl7:TD7iuqSTQBjIthfqXl

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2412	1376	WerFault.exe	63

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 1376	1512	rundll32.exe	63
PID 1512 wrote to memory of 1376	1512	rundll32.exe	63
PID 1512 wrote to memory of 1376	1512	rundll32.exe	63

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\77aab0c0bc4bb4da132f40efea403e1afb5535b9668bd8c7e39fe767ed5669d7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\77aab0c0bc4bb4da132f40efea403e1afb5535b9668bd8c7e39fe767ed5669d7.dll,#1
  2⤵
  PID:1376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 572
    3⤵
    - Program crash
    PID:2412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1376 -ip 1376
1⤵
PID:2216