c4d201b84c67dcecac797799667cb8a0cf1fbd20ca02415ee28fae2254d083ce

Analysis

max time kernel
92s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 16:11

Target

c4d201b84c67dcecac797799667cb8a0cf1fbd20ca02415ee28fae2254d083ce.dll
Size

674KB
MD5

a4c92562304c3d01be3b25c1ac7ce93b
SHA1

1033022b9f51c427ea702b883096bbe023e20282
SHA256

c4d201b84c67dcecac797799667cb8a0cf1fbd20ca02415ee28fae2254d083ce
SHA512

ebc5dc9e8369fabb6e1574602055b6ec2c32377bd7315816e0b28edc8b59e44810e206aa2d1cf1d89ce2f2fa20c02a66257966a3d957bf6a7e41be75183a4b61
SSDEEP

12288:Zmk8mDyLRPH9Dsm3QmRm/wj8xcGOYXHjDzj60zY1sIjsWVgm7DzVzIwC:Mk8mDyLpdDsm3QJ/wYxcoXH/6kY1HjnW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1544	3672	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 488 wrote to memory of 3672	488	rundll32.exe	79
PID 488 wrote to memory of 3672	488	rundll32.exe	79
PID 488 wrote to memory of 3672	488	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c4d201b84c67dcecac797799667cb8a0cf1fbd20ca02415ee28fae2254d083ce.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:488
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c4d201b84c67dcecac797799667cb8a0cf1fbd20ca02415ee28fae2254d083ce.dll,#1
  2⤵
  PID:3672
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 544
    3⤵
    - Program crash
    PID:1544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3672 -ip 3672
1⤵
PID:4996