91d668d8f3620518050b12eeb9baf4bdbe732d2a1da9b0e8da2103866b860a5c

Analysis

max time kernel
160s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 01:16

Target

91d668d8f3620518050b12eeb9baf4bdbe732d2a1da9b0e8da2103866b860a5c.dll
Size

239KB
MD5

71825747dd4c6e5fc7db7e729e28ebfa
SHA1

c41bea92fe2cc90869a4844b35b6ef7a8fe03111
SHA256

91d668d8f3620518050b12eeb9baf4bdbe732d2a1da9b0e8da2103866b860a5c
SHA512

473fe6769717d923c5b59f241c3d5a258b43481aea860f0970b9ee7cd304ccd04c6c67a58623f85028f697759b4c0c271c3b40b7dccd484fe35db58f1068c457
SSDEEP

6144:RKFsVVG+sugtdiaYM7bWFMHBTqOFckF7mB5b:YmzEugbsM76eBTX0H

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4020	668	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 668	1716	rundll32.exe	81
PID 1716 wrote to memory of 668	1716	rundll32.exe	81
PID 1716 wrote to memory of 668	1716	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\91d668d8f3620518050b12eeb9baf4bdbe732d2a1da9b0e8da2103866b860a5c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\91d668d8f3620518050b12eeb9baf4bdbe732d2a1da9b0e8da2103866b860a5c.dll,#1
  2⤵
  PID:668
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 668 -s 580
    3⤵
    - Program crash
    PID:4020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 668 -ip 668
1⤵
PID:3272