a55c1296963b62c12c6e4486ba6c9997911165f6bd68e8cf8da04e7bf9686278

Analysis

max time kernel
151s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 09:46

Target

a55c1296963b62c12c6e4486ba6c9997911165f6bd68e8cf8da04e7bf9686278.dll
Size

560KB
MD5

d40aac7022975980a04c34b418eb5120
SHA1

a842e9ca3fc954fe02a8e9b3005857c9c00f7f09
SHA256

a55c1296963b62c12c6e4486ba6c9997911165f6bd68e8cf8da04e7bf9686278
SHA512

186a93d2ea2d7f5ab22b6316e513bf17be46393fb26202965431f8a1cc5a4edc89db292475a667705a136e57c1e972bb3bab6f07e05ced4718df3c82e664e165
SSDEEP

12288:IiY0EJ5OYJ/b+jM+j2TAb7z/gAJQjqpdBuA:XY0wpF+A+/gkQjqfBu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4044	3880	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 3880	4520	rundll32.exe	80
PID 4520 wrote to memory of 3880	4520	rundll32.exe	80
PID 4520 wrote to memory of 3880	4520	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a55c1296963b62c12c6e4486ba6c9997911165f6bd68e8cf8da04e7bf9686278.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a55c1296963b62c12c6e4486ba6c9997911165f6bd68e8cf8da04e7bf9686278.dll,#1
  2⤵
  PID:3880
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 848
    3⤵
    - Program crash
    PID:4044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 3880 -ip 3880
1⤵
PID:2268