9fd3b62b51c93982ef86c21cf113454fb6ec8b0d8d6b95e3688702efbb688fa6

Analysis

max time kernel
66s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 00:21

Target

9fd3b62b51c93982ef86c21cf113454fb6ec8b0d8d6b95e3688702efbb688fa6.dll
Size

229KB
MD5

e38f362e49d134aadf6c6af65287017f
SHA1

a42a0f623ed7630a684fa34a7807da0fe29323dd
SHA256

9fd3b62b51c93982ef86c21cf113454fb6ec8b0d8d6b95e3688702efbb688fa6
SHA512

6b7f4341595eb6294f2fa755909537487fd414a1bfa560809fd5955ca22c3d215e97aeaf480cdc72e1d5662c93258632a27deb66a59883d0705b6b5e0d195ed4
SSDEEP

6144:DbDIxbMkCuC/tObjxDfI9QhLg1lFDBPetoVSl1B:vDwbMkCuHFmQhLg1lF9PEok9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3940	4760	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 4760	2804	rundll32.exe	80
PID 2804 wrote to memory of 4760	2804	rundll32.exe	80
PID 2804 wrote to memory of 4760	2804	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9fd3b62b51c93982ef86c21cf113454fb6ec8b0d8d6b95e3688702efbb688fa6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9fd3b62b51c93982ef86c21cf113454fb6ec8b0d8d6b95e3688702efbb688fa6.dll,#1
  2⤵
  PID:4760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 580
    3⤵
    - Program crash
    PID:3940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4760 -ip 4760
1⤵
PID:2764