4b0353634c2f7b05aec9ee10935f1d2b8f869b77ad3ac564effe0f959daf8c15

Analysis

max time kernel
152s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 04:39

Target

4b0353634c2f7b05aec9ee10935f1d2b8f869b77ad3ac564effe0f959daf8c15.dll
Size

56KB
MD5

b223f7e9f3112683150ff0af092fbf80
SHA1

bb5515499fb3f297786c5ad98b2d167b75da051a
SHA256

4b0353634c2f7b05aec9ee10935f1d2b8f869b77ad3ac564effe0f959daf8c15
SHA512

cf1160b3a1fc4deba18c839bfcfff749e88bd45c70578860577a77cf235800b0a6dec7c3ab6c1edebc4623326f4f806353eb59aa1363613cffeeecf72f1adfe0
SSDEEP

768:OCs2g4T7She14Rme58//lDoyYX0uteYDIdA1o9B4o:vbg4fSheOmTlDPYXBM8oP4o

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1736	812	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 812	4312	rundll32.exe	83
PID 4312 wrote to memory of 812	4312	rundll32.exe	83
PID 4312 wrote to memory of 812	4312	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b0353634c2f7b05aec9ee10935f1d2b8f869b77ad3ac564effe0f959daf8c15.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b0353634c2f7b05aec9ee10935f1d2b8f869b77ad3ac564effe0f959daf8c15.dll,#1
  2⤵
  PID:812
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 812 -s 572
    3⤵
    - Program crash
    PID:1736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 812 -ip 812
1⤵
PID:4476