8055ce5a4cc35e1d9a9cd4700626231067a2c03f4475e5e03305ff5c0161d6b8

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 22:23

Target

8055ce5a4cc35e1d9a9cd4700626231067a2c03f4475e5e03305ff5c0161d6b8.dll
Size

149KB
MD5

4f2279ae05d36e31ff31476600bcbca8
SHA1

c4641ef21d9a9fd8cc236a920465ea0ad68a7e03
SHA256

8055ce5a4cc35e1d9a9cd4700626231067a2c03f4475e5e03305ff5c0161d6b8
SHA512

27d568334b568b4e563f2c3be685df901f1eaa011c567f787538e7675ecfbed5ae5cda1bb41a57d3f409808406246ec091d5536becf2aa5d5bf269615719e1cd
SSDEEP

3072:aqW8h34ZG8tpm8oydrj2lRUW0/graVWj7Qu258vD9+dKrIBs:tW8hEegZ7IWVU25W9+dW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2960	3720	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 3720	3488	rundll32.exe	81
PID 3488 wrote to memory of 3720	3488	rundll32.exe	81
PID 3488 wrote to memory of 3720	3488	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8055ce5a4cc35e1d9a9cd4700626231067a2c03f4475e5e03305ff5c0161d6b8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8055ce5a4cc35e1d9a9cd4700626231067a2c03f4475e5e03305ff5c0161d6b8.dll,#1
  2⤵
  PID:3720
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 600
    3⤵
    - Program crash
    PID:2960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3720 -ip 3720
1⤵
PID:4760