f2942e63b4c41343e587a7d3571c66787297b0426cf68396d5cc95293a0735fa

Analysis

max time kernel
203s
max time network
211s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 09:52

Target

f2942e63b4c41343e587a7d3571c66787297b0426cf68396d5cc95293a0735fa.dll
Size

206KB
MD5

eaa0ebd877b7cdf0d5012400d01c6b80
SHA1

cdd3effccc483eaad9b2a7fe6994f8799c1f6ed3
SHA256

f2942e63b4c41343e587a7d3571c66787297b0426cf68396d5cc95293a0735fa
SHA512

523bbdecd72d272d12c3da0876505e07472d959b0961d436c664259aa11b88cb3855e3a1bbe6076a8f093c17da2960a15ae05b113955332ab0d0762dfaad8537
SSDEEP

6144:0hwav76X/lmXn2gkbUiLlzgBpPSYQktQ:0Gav7o4X7kjLVmlSYX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
240	1824	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4424 wrote to memory of 1824	4424	rundll32.exe	83
PID 4424 wrote to memory of 1824	4424	rundll32.exe	83
PID 4424 wrote to memory of 1824	4424	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f2942e63b4c41343e587a7d3571c66787297b0426cf68396d5cc95293a0735fa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f2942e63b4c41343e587a7d3571c66787297b0426cf68396d5cc95293a0735fa.dll,#1
  2⤵
  PID:1824
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 592
    3⤵
    - Program crash
    PID:240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1824 -ip 1824
1⤵
PID:4088