431d3a727ccb9ad655d80a4edd230ad944832152899ecffd0f4e04ca46d945ca

Analysis

max time kernel
91s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 14:16

Target

431d3a727ccb9ad655d80a4edd230ad944832152899ecffd0f4e04ca46d945ca.dll
Size

112KB
MD5

4f7da4452d7d7e279238b95dbfe0f98c
SHA1

85d8db58e50ebc64f180b791bf7a5c62f9497dcf
SHA256

431d3a727ccb9ad655d80a4edd230ad944832152899ecffd0f4e04ca46d945ca
SHA512

161447d7af0388cc1b4b56c28b25d8a89ed7335577e0cafdfd03a8315b445723a8d2a0e18e0fcbdfc8e6258eb34652eb4ab2396ad08cd299a1cfc1e8bc1589b7
SSDEEP

1536:gFy23wGyKNqwtbTtHn6/0+jLbplcXDGuysUfLsD95V4B5BxS:gFFzqCZHoZj72LyjLK93E5BxS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4904	4956	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 4956	5064	rundll32.exe	81
PID 5064 wrote to memory of 4956	5064	rundll32.exe	81
PID 5064 wrote to memory of 4956	5064	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\431d3a727ccb9ad655d80a4edd230ad944832152899ecffd0f4e04ca46d945ca.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\431d3a727ccb9ad655d80a4edd230ad944832152899ecffd0f4e04ca46d945ca.dll,#1
  2⤵
  PID:4956
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 592
    3⤵
    - Program crash
    PID:4904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4956 -ip 4956
1⤵
PID:3124