be2adba779cdaf915dbf7f94b78674471ce1646a1d9c39f94ef64c09ee823ea2

Analysis

max time kernel
147s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 18:31

Target

be2adba779cdaf915dbf7f94b78674471ce1646a1d9c39f94ef64c09ee823ea2.dll
Size

174KB
MD5

6bf6420e912ef2529564add8b47d5cf3
SHA1

4fc918ba0adf8ff99cdd8b2e35f0103cc4fc9c9e
SHA256

be2adba779cdaf915dbf7f94b78674471ce1646a1d9c39f94ef64c09ee823ea2
SHA512

1babd377a6d2ecad2318465862abb08c5fc3d887b4b3a4d39b4bb8a81315c8a55e692653c0139f950c5d5281afcf101c67bd38ce4c755ba0d3308adef2fd5bfd
SSDEEP

3072:m5zTeFysa5jQyrb9leKJ3ACunj6mYC57U6RjGG1bQBJIhDmLLIwNEHimtmUi2:mIFysa5jQyrbDo6o/MJIZIlE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1444	3360	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 100 wrote to memory of 3360	100	rundll32.exe	83
PID 100 wrote to memory of 3360	100	rundll32.exe	83
PID 100 wrote to memory of 3360	100	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\be2adba779cdaf915dbf7f94b78674471ce1646a1d9c39f94ef64c09ee823ea2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\be2adba779cdaf915dbf7f94b78674471ce1646a1d9c39f94ef64c09ee823ea2.dll,#1
  2⤵
  PID:3360
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 572
    3⤵
    - Program crash
    PID:1444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3360 -ip 3360
1⤵
PID:4392