0d459e5fed3b8297e98ae70e45203bafac0a0f8a0ff572ea6c94bc353d4bd522

Analysis

max time kernel
154s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 14:33

Target

0d459e5fed3b8297e98ae70e45203bafac0a0f8a0ff572ea6c94bc353d4bd522.dll
Size

125KB
MD5

fb4ddf47fe9ee8bdc4c2c3fe979c6800
SHA1

662fd36ea8635f95e9332c580d70445e589a4b75
SHA256

0d459e5fed3b8297e98ae70e45203bafac0a0f8a0ff572ea6c94bc353d4bd522
SHA512

14c5e570afa13d633dbd8c194c5fc7a6ccb96431dc254cb38bb92bc69a7103c55619e3e38a7daaa96266a3e76bea5dd0641f997b3a953cb934abc894b74dfa3b
SSDEEP

1536:nsdmguQ8rv/jbj/mFomnMV3oX4ShLtJrJAjfDfYXlfl:ns9p8rv/3VWMeLtJ+jfDfYXl

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2184	3872	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 3872	4248	rundll32.exe	82
PID 4248 wrote to memory of 3872	4248	rundll32.exe	82
PID 4248 wrote to memory of 3872	4248	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d459e5fed3b8297e98ae70e45203bafac0a0f8a0ff572ea6c94bc353d4bd522.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d459e5fed3b8297e98ae70e45203bafac0a0f8a0ff572ea6c94bc353d4bd522.dll,#1
  2⤵
  PID:3872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 660
    3⤵
    - Program crash
    PID:2184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3872 -ip 3872
1⤵
PID:3216