1430e5e94489cc34317b16bda414ad5bcf1d7feb469fc4613f2ea78c32d3b4b1

Analysis

max time kernel
184s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 06:33

Target

1430e5e94489cc34317b16bda414ad5bcf1d7feb469fc4613f2ea78c32d3b4b1.dll
Size

204KB
MD5

d2e7f76fb22814ce0ac46f30c60044b0
SHA1

ef20f2f8fed1ce2bc842dff0a9f67230fc9d47ec
SHA256

1430e5e94489cc34317b16bda414ad5bcf1d7feb469fc4613f2ea78c32d3b4b1
SHA512

dc3e2df9b2dd29401cd69ffa1aa577d8f9e4a464b5fef4f6d04a948dc7b5cb26db2a8c2f20e75344eff1778cefe633f8ccc94a717b4b723d601d1b8cb6642e26
SSDEEP

3072:9Ed8TBk7iWpIxdyDI23HdfSkJuYb5+AnPyVL3XHSscxRYjmH0qHpcO5VSneoEt5f:k26JS2py2toEtOE

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4536	5060	WerFault.exe	78
4748	5060	WerFault.exe	78

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 5060	2640	rundll32.exe	78
PID 2640 wrote to memory of 5060	2640	rundll32.exe	78
PID 2640 wrote to memory of 5060	2640	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1430e5e94489cc34317b16bda414ad5bcf1d7feb469fc4613f2ea78c32d3b4b1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1430e5e94489cc34317b16bda414ad5bcf1d7feb469fc4613f2ea78c32d3b4b1.dll,#1
  2⤵
  PID:5060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 596
    3⤵
    - Program crash
    PID:4536
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 840
    3⤵
    - Program crash
    PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 5060 -ip 5060
1⤵
PID:4228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5060 -ip 5060
1⤵
PID:5084