e54e7abd97eb5f61e52d158f7d71e3e8d073ebae2a3ba155f49b825499646d49

Analysis

max time kernel
157s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 10:52

Target

e54e7abd97eb5f61e52d158f7d71e3e8d073ebae2a3ba155f49b825499646d49.dll
Size

215KB
MD5

e45ea76f4e3c00c2623f9f542414b723
SHA1

5ad4d633a82448f8fd1fec2e100abae0f37a6aa0
SHA256

e54e7abd97eb5f61e52d158f7d71e3e8d073ebae2a3ba155f49b825499646d49
SHA512

bdf38faaa4a96142f1c9097c868fdb989327a9321dbf976997e141efab95ef0d582416091ffc6ab1d2ec2f91610756b9eed1d60e91dca4f52da663e447377e53
SSDEEP

3072:IR+NKz4vu9lHFloL/zlEcOOB+/xXDmHJCXdHUoh+at8wYF9IoL9Y8B7MdL:E0QllGzKcPWxTkCXdHU7wuO+8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4848	3192	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 3192	2688	rundll32.exe	83
PID 2688 wrote to memory of 3192	2688	rundll32.exe	83
PID 2688 wrote to memory of 3192	2688	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e54e7abd97eb5f61e52d158f7d71e3e8d073ebae2a3ba155f49b825499646d49.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e54e7abd97eb5f61e52d158f7d71e3e8d073ebae2a3ba155f49b825499646d49.dll,#1
  2⤵
  PID:3192
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 584
    3⤵
    - Program crash
    PID:4848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3192 -ip 3192
1⤵
PID:5116