cf383460f43a4ba93d9c2f7692a166bfea95246f40e4e36e7fa20f3f6a8f5b08

Analysis

max time kernel
154s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 17:21

Target

cf383460f43a4ba93d9c2f7692a166bfea95246f40e4e36e7fa20f3f6a8f5b08.dll
Size

439KB
MD5

1c462d47ef2101bfb406ed68ec8418e7
SHA1

cb7635799e681ed79a42a8d6d8f5ff260bc238b2
SHA256

cf383460f43a4ba93d9c2f7692a166bfea95246f40e4e36e7fa20f3f6a8f5b08
SHA512

8f53c131e83fdac6eddfaf011510b2225e7f4e4eed0a461824f11cfede9dbf445bca47b3cb12bbcf763b58e30cc3b62f1205914f1a46c4a6de37247b690a2b8c
SSDEEP

6144:WqYX9KGCc5x1gsS9dO3Ou47yAXd1g/iEyi9Jn3MQz8fWARUV3TV5:u9T9xYju4/y/1d9JnVPOw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4112	2348	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 2348	2064	rundll32.exe	80
PID 2064 wrote to memory of 2348	2064	rundll32.exe	80
PID 2064 wrote to memory of 2348	2064	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf383460f43a4ba93d9c2f7692a166bfea95246f40e4e36e7fa20f3f6a8f5b08.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf383460f43a4ba93d9c2f7692a166bfea95246f40e4e36e7fa20f3f6a8f5b08.dll,#1
  2⤵
  PID:2348
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 600
    3⤵
    - Program crash
    PID:4112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2348 -ip 2348
1⤵
PID:1392