fd4719b6df0776382f0d5b3a0a6a90ff8eb77afc0214a8cba1ae1933c295bc8d

Analysis

max time kernel
88s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 15:49

Target

fd4719b6df0776382f0d5b3a0a6a90ff8eb77afc0214a8cba1ae1933c295bc8d.dll
Size

62KB
MD5

1ef96379f3c1725d4961b0599d5aa931
SHA1

c04faa68d5d4f0ef8f23dcc1db0a199db738d0f7
SHA256

fd4719b6df0776382f0d5b3a0a6a90ff8eb77afc0214a8cba1ae1933c295bc8d
SHA512

04c7f5e391a74119255a31daa97105199b1260e8262a599cac4538048bcdc06668950c4e0141417cad578fab454934b787e62b3a8b2922c621546c0c95007f63
SSDEEP

1536:eQVfezDhX6HABLMMcJoz7LJLleOOtJ5ZhFn0wcccccccc:vqYAdUJW7L1leOOL5PFn0wcccccccc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2924	4232	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 4232	4496	rundll32.exe	81
PID 4496 wrote to memory of 4232	4496	rundll32.exe	81
PID 4496 wrote to memory of 4232	4496	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd4719b6df0776382f0d5b3a0a6a90ff8eb77afc0214a8cba1ae1933c295bc8d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd4719b6df0776382f0d5b3a0a6a90ff8eb77afc0214a8cba1ae1933c295bc8d.dll,#1
  2⤵
  PID:4232
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 544
    3⤵
    - Program crash
    PID:2924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4232 -ip 4232
1⤵
PID:2764