711aefc9c29ea5177526dd7c5e9f47f7e51feb4bec4f6d03351ff118bef309f7

Analysis

max time kernel
176s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 22:57

Target

711aefc9c29ea5177526dd7c5e9f47f7e51feb4bec4f6d03351ff118bef309f7.dll
Size

654KB
MD5

2f1b7f05512e4e8a5f084bc82ebbd982
SHA1

265bc05fb9cffcac38eeef27952904b53f534674
SHA256

711aefc9c29ea5177526dd7c5e9f47f7e51feb4bec4f6d03351ff118bef309f7
SHA512

8cc16c165484462306da0c3ed705b0775ecfafb61ef5fec790671a3f7b0091c8e45e86c1a54a9ae2e3d6859b506422e7bb1345b4e511d975cc975635dacf852c
SSDEEP

12288:g9UVYnskCt71MBbueE5VeT2M8DI6UduKsXxDADA1cxGdk:g9ykCtZmbun5C8DgsnXxDkA1yG+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4100	2468	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 2468	3452	rundll32.exe	79
PID 3452 wrote to memory of 2468	3452	rundll32.exe	79
PID 3452 wrote to memory of 2468	3452	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\711aefc9c29ea5177526dd7c5e9f47f7e51feb4bec4f6d03351ff118bef309f7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\711aefc9c29ea5177526dd7c5e9f47f7e51feb4bec4f6d03351ff118bef309f7.dll,#1
  2⤵
  PID:2468
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 584
    3⤵
    - Program crash
    PID:4100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2468 -ip 2468
1⤵
PID:5112