6f63f6cfc5edb3ec07b880db789c391bf355c94cf96a3e3a04e5a7fbb27ae67c

Analysis

max time kernel
170s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 08:01

Target

6f63f6cfc5edb3ec07b880db789c391bf355c94cf96a3e3a04e5a7fbb27ae67c.dll
Size

112KB
MD5

39cf52fb1646cf56c68d50ffb0968dd0
SHA1

1fd68936c79f45333ecb41bbbfeedd7c177ce38b
SHA256

6f63f6cfc5edb3ec07b880db789c391bf355c94cf96a3e3a04e5a7fbb27ae67c
SHA512

74b13089b6601b73bc564857d150180624fea72f1a2d3d207215d661aef775fa06624bc6b7b29a1b22279de0f6c5b4b0ef4e36a49c58f5bb8698aaa313505a50
SSDEEP

3072:PR94LKHqmfqSbSV8gsAEajKiEdw+7Wsee:J94LKK+qSbtUEk3Gw+Csee

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3504	628	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 628	3448	rundll32.exe	82
PID 3448 wrote to memory of 628	3448	rundll32.exe	82
PID 3448 wrote to memory of 628	3448	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6f63f6cfc5edb3ec07b880db789c391bf355c94cf96a3e3a04e5a7fbb27ae67c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6f63f6cfc5edb3ec07b880db789c391bf355c94cf96a3e3a04e5a7fbb27ae67c.dll,#1
  2⤵
  PID:628
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 656
    3⤵
    - Program crash
    PID:3504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 628 -ip 628
1⤵
PID:2600