2446f2174aa38fd1755b707534c40341c6f560cfcabe4c63809e871280e4f379

Analysis

max time kernel
90s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 10:19

Target

2446f2174aa38fd1755b707534c40341c6f560cfcabe4c63809e871280e4f379.dll
Size

164KB
MD5

a22f23ca641f17ec86983e54f200b7c1
SHA1

c5f08bf8210f42b4cbd6cc27772b61c5adfcb498
SHA256

2446f2174aa38fd1755b707534c40341c6f560cfcabe4c63809e871280e4f379
SHA512

b9044518820b950b98abdf93c896ee9fc6b29b2f9374985b3977fe6ab60a06ad16d1abc735422858fd4d09a726dad7eee4b9a72107dd647c78468e4d57d92646
SSDEEP

3072:S8P/zfbA3pzrQ9sjxFNcI1T4lhAQpawlGtHgBz64jIjbO7ytqfEVsRJfa5fCwAQE:n/zfbA3pzIsdUgMrAQpajCdC5ks7A

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4972	3040	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 3040	2376	rundll32.exe	81
PID 2376 wrote to memory of 3040	2376	rundll32.exe	81
PID 2376 wrote to memory of 3040	2376	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2446f2174aa38fd1755b707534c40341c6f560cfcabe4c63809e871280e4f379.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2446f2174aa38fd1755b707534c40341c6f560cfcabe4c63809e871280e4f379.dll,#1
  2⤵
  PID:3040
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 600
    3⤵
    - Program crash
    PID:4972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3040 -ip 3040
1⤵
PID:5012