41cca5030c41df306a718918007e2234ff6d31baac2883ae0d8df92e75649bf2

Analysis

max time kernel
153s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 11:18

Target

41cca5030c41df306a718918007e2234ff6d31baac2883ae0d8df92e75649bf2.dll
Size

121KB
MD5

e39575a7c4379e1dbd3fe248723c50b0
SHA1

282bbc460087520cd15e8e0c6cecd146c40853b7
SHA256

41cca5030c41df306a718918007e2234ff6d31baac2883ae0d8df92e75649bf2
SHA512

86e03ed411dfee09830652133d370c7e043a3a5e36d3e36ea9c79b39b4020e9470d8bced4328f61ef1ee67bbb4390ff1522ce7996917de45fd7696eb3aeec810
SSDEEP

3072:4FoQaBWdMHJNsuNjfQU0OhgH0TNsgWPPLdpBj5RFY:4FoQJMEuuihGuNs1PPLdpBj5w

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4544	4928	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 4928	4900	rundll32.exe	81
PID 4900 wrote to memory of 4928	4900	rundll32.exe	81
PID 4900 wrote to memory of 4928	4900	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\41cca5030c41df306a718918007e2234ff6d31baac2883ae0d8df92e75649bf2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\41cca5030c41df306a718918007e2234ff6d31baac2883ae0d8df92e75649bf2.dll,#1
  2⤵
  PID:4928
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 656
    3⤵
    - Program crash
    PID:4544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4928 -ip 4928
1⤵
PID:2024