63ea21a36fc87d840c094581cc4b0a4a974c2c0910d9425f4f8eb696ae52e099

Analysis

max time kernel
179s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 23:19

Target

63ea21a36fc87d840c094581cc4b0a4a974c2c0910d9425f4f8eb696ae52e099.dll
Size

412KB
MD5

48de75d8b4a464998121682b80475e5f
SHA1

2afb747092ba69f49c738197434e0cd2ad81ee2e
SHA256

63ea21a36fc87d840c094581cc4b0a4a974c2c0910d9425f4f8eb696ae52e099
SHA512

7ab4ad9bc457bc8b15e48970e75b9e4aa0dd20f051edd8078076957b7079b38676a8f281f9617847a2952d1d3e719b62f5ef62dae20c2d8b90ca31c9856b691a
SSDEEP

6144:yYPss2uQdVth7ae1GNbYwJYPd8Rr+Q2p73I+E7viF1T6412juFBHq+t+NB:yYF2n3th+e1GxXJ4GRq774zK2tieXL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3892	4600	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 4600	3088	rundll32.exe	82
PID 3088 wrote to memory of 4600	3088	rundll32.exe	82
PID 3088 wrote to memory of 4600	3088	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\63ea21a36fc87d840c094581cc4b0a4a974c2c0910d9425f4f8eb696ae52e099.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\63ea21a36fc87d840c094581cc4b0a4a974c2c0910d9425f4f8eb696ae52e099.dll,#1
  2⤵
  PID:4600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 596
    3⤵
    - Program crash
    PID:3892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4600 -ip 4600
1⤵
PID:4436