2606653fd46127b75c630e3d45bcf6dbbe1a6a47de905394dc608d59fdfc5633

Analysis

max time kernel
149s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 06:09

Target

2606653fd46127b75c630e3d45bcf6dbbe1a6a47de905394dc608d59fdfc5633.dll
Size

46KB
MD5

88bf63c803f83805323c8d66379990f0
SHA1

06fdfaa8f020bab0fd7f6ecb7ca69a6597c88141
SHA256

2606653fd46127b75c630e3d45bcf6dbbe1a6a47de905394dc608d59fdfc5633
SHA512

21f808a6f7370b6a02eb55e38d8f4abbfbf44243c659fad2befadf3b7f2cc5ade2e03a4a2f112ea5fa2ccdb17a5481938c9b4cda461ce3b6260c988722ded87c
SSDEEP

768:pojunt/ZDW51QLNfjI1VklaljgufT6M/OFpy3no9eYph2:ztBaSNr0VYw0ufT6MWFpeocYv2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2432	2260	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3792 wrote to memory of 2260	3792	rundll32.exe	79
PID 3792 wrote to memory of 2260	3792	rundll32.exe	79
PID 3792 wrote to memory of 2260	3792	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2606653fd46127b75c630e3d45bcf6dbbe1a6a47de905394dc608d59fdfc5633.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2606653fd46127b75c630e3d45bcf6dbbe1a6a47de905394dc608d59fdfc5633.dll,#1
  2⤵
  PID:2260
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 544
    3⤵
    - Program crash
    PID:2432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2260 -ip 2260
1⤵
PID:3060