805b7db99981f3b72d1b770baf5ef90f8a2adb8fe92703583f21b55633e7ee9c

Analysis

max time kernel
140s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 02:29

Target

805b7db99981f3b72d1b770baf5ef90f8a2adb8fe92703583f21b55633e7ee9c.dll
Size

79KB
MD5

5eeac1a840ab0b99a48ad6d680cd5c9d
SHA1

4fca48dbeef3a98f88cee6f7355c3c30c9c47c6a
SHA256

805b7db99981f3b72d1b770baf5ef90f8a2adb8fe92703583f21b55633e7ee9c
SHA512

c1c3c392748af586ec616c7bf4cffa0f3ad3fe8a649fadab0e726f568dd900ac63815c336e0d3bec6fce61c83ce240c722dc1a7cdeac3d7be1ea6ebde6afd5f8
SSDEEP

1536:BxDZ0RZ8nljO6mK2fFsGQqptxccuEaC8pSIaJoX+bZBWy/aRQWmfIm:xjnljbADNecuQ8sIEoXI71SLmfI

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
32	4200	WerFault.exe	82
3520	4200	WerFault.exe	82

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 4200	4560	rundll32.exe	82
PID 4560 wrote to memory of 4200	4560	rundll32.exe	82
PID 4560 wrote to memory of 4200	4560	rundll32.exe	82
PID 4200 wrote to memory of 32	4200	rundll32.exe	84
PID 4200 wrote to memory of 32	4200	rundll32.exe	84
PID 4200 wrote to memory of 32	4200	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\805b7db99981f3b72d1b770baf5ef90f8a2adb8fe92703583f21b55633e7ee9c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\805b7db99981f3b72d1b770baf5ef90f8a2adb8fe92703583f21b55633e7ee9c.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4200 -s 584
    3⤵
    - Program crash
    PID:32
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4200 -s 584
    3⤵
    - Program crash
    PID:3520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4200 -ip 4200
1⤵
PID:2508