46971cfdacb87c0fda32634b073cd0622d531a04897be294c998ff701aaaa549

Analysis

max time kernel
153s
max time network
205s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 09:23

Target

46971cfdacb87c0fda32634b073cd0622d531a04897be294c998ff701aaaa549.dll
Size

647KB
MD5

6afe60b199ba375023c0850cca355180
SHA1

5417fcc8d521fbe75f9559ad272b8838f1a9bb26
SHA256

46971cfdacb87c0fda32634b073cd0622d531a04897be294c998ff701aaaa549
SHA512

2a4d555d92d067e3e615affbd2944f2575749aa9442bd369871527898209f5f9ff09e993f3cbe3e5b40eb32b60f90838379a18ce70482bb33834958dcfcaf5ae
SSDEEP

12288:EqQ0iGkfOWwlK5lpoLHHz8JrpQ4n2T1RLv3F:rQf9fOVIYLzE29T3LvV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2084	4392	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3360 wrote to memory of 4392	3360	rundll32.exe	83
PID 3360 wrote to memory of 4392	3360	rundll32.exe	83
PID 3360 wrote to memory of 4392	3360	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\46971cfdacb87c0fda32634b073cd0622d531a04897be294c998ff701aaaa549.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\46971cfdacb87c0fda32634b073cd0622d531a04897be294c998ff701aaaa549.dll,#1
  2⤵
  PID:4392
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4392 -s 584
    3⤵
    - Program crash
    PID:2084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4392 -ip 4392
1⤵
PID:1444