105d559e28ac78b526914c3b17c193b7a51da8d6e033b9271a2c7f59e7faa885

Analysis

max time kernel
137s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 10:50

Target

105d559e28ac78b526914c3b17c193b7a51da8d6e033b9271a2c7f59e7faa885.dll
Size

52KB
MD5

fd2e2bdc80ceb7933386b6465a0eff20
SHA1

7b53746503509bfa20110b06697a856f762c6302
SHA256

105d559e28ac78b526914c3b17c193b7a51da8d6e033b9271a2c7f59e7faa885
SHA512

0095ea03b4ef0e00c1b099d231d1dd4958ab608ade49c9381f2c445c878c3f6da0a01d60e94a7c80967a6e926a8be2a5ddeaff7ebd03bd1c301c69cdaf29744d
SSDEEP

768:lyOYs0Ci3T9qLkIB+0yM1/CWdoYqTjGa4EhRtIQ9hd+HPWVunTEDHA7wjc9:lZzi34LkkV/RdoF7ecUHP7EW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5068	3544	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 676 wrote to memory of 3544	676	rundll32.exe	83
PID 676 wrote to memory of 3544	676	rundll32.exe	83
PID 676 wrote to memory of 3544	676	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\105d559e28ac78b526914c3b17c193b7a51da8d6e033b9271a2c7f59e7faa885.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\105d559e28ac78b526914c3b17c193b7a51da8d6e033b9271a2c7f59e7faa885.dll,#1
  2⤵
  PID:3544
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 600
    3⤵
    - Program crash
    PID:5068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3544 -ip 3544
1⤵
PID:2620