6fa732a4055642c6d456e57a17a5b32b951c610fcc8567d52dbb8744baaeee58

Analysis

max time kernel
204s
max time network
213s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 08:01

Target

6fa732a4055642c6d456e57a17a5b32b951c610fcc8567d52dbb8744baaeee58.dll
Size

446KB
MD5

52346a21daff3fe05634d2fd1ab43300
SHA1

de06fd03a53e791c0b47679dbde076b367bbe275
SHA256

6fa732a4055642c6d456e57a17a5b32b951c610fcc8567d52dbb8744baaeee58
SHA512

59366ac85a08de0294756d3c348bf039fdb3954ada9ed64b98a86ff46852a8f2fb173c4a242164bbd0b64b330fcbd939628a668e0ae5e67a159f149c81ce331b
SSDEEP

6144:pj93mp032Nb7Db9FpXJq9DnwBiCpBmhe+YyD5FS+5nSjKQdTzRcSXsNtdHMRNgPP:r3eg2NLPO9sD2PH/SjlCSYNMRNG3UCl

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3228	744	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 744	1456	rundll32.exe	83
PID 1456 wrote to memory of 744	1456	rundll32.exe	83
PID 1456 wrote to memory of 744	1456	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6fa732a4055642c6d456e57a17a5b32b951c610fcc8567d52dbb8744baaeee58.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6fa732a4055642c6d456e57a17a5b32b951c610fcc8567d52dbb8744baaeee58.dll,#1
  2⤵
  PID:744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 744 -s 576
    3⤵
    - Program crash
    PID:3228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 744 -ip 744
1⤵
PID:4888