a74e6243f1d0481feec6b1d61eec60c21a0986e68702b823f4e6670d399e8865

Analysis

max time kernel
183s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
30/11/2022, 23:48

Target

a74e6243f1d0481feec6b1d61eec60c21a0986e68702b823f4e6670d399e8865.dll
Size

52KB
MD5

7df3d549195b78941c8717becad28730
SHA1

41477c3f9e86ecee13179b874ba5492ebcac5dbf
SHA256

a74e6243f1d0481feec6b1d61eec60c21a0986e68702b823f4e6670d399e8865
SHA512

d97e9df968618144fc85a79a058dffa15388b2eb495f18a038054aa885a1aaf5552dcc99e7860535e43fdee83015388116503c2a198ba47930d7255e5d140c30
SSDEEP

768:lyOYs0Ci3T9qLkIB+0yM1/CWdoYqTjGa4EhRtIQ9hd+HPWVunTEDHA7wjcM:lZzi34LkkV/RdoF7ecUHP7ET

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4380	212	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 212	4764	rundll32.exe	82
PID 4764 wrote to memory of 212	4764	rundll32.exe	82
PID 4764 wrote to memory of 212	4764	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a74e6243f1d0481feec6b1d61eec60c21a0986e68702b823f4e6670d399e8865.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a74e6243f1d0481feec6b1d61eec60c21a0986e68702b823f4e6670d399e8865.dll,#1
  2⤵
  PID:212
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 212 -s 600
    3⤵
    - Program crash
    PID:4380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 212 -ip 212
1⤵
PID:4272