c9ab30ceb91310aafdd4860227880fa6fbcbf6f573e129df4d88d53e56b72230

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 17:46

Target

c9ab30ceb91310aafdd4860227880fa6fbcbf6f573e129df4d88d53e56b72230.dll
Size

52KB
MD5

3a906f2db76e4ddd508eb1bc831ca4c3
SHA1

2e01490352714a2f910857ac2789d1025cbfc726
SHA256

c9ab30ceb91310aafdd4860227880fa6fbcbf6f573e129df4d88d53e56b72230
SHA512

bc97c126a7a907e98720fec7ed439be61775990cc95c18b4b9b447a266b5159ffa4b408ba4e97c9f2a6a8d7663825e3e5eb69590cfa35edf4497cec80f5b8a94
SSDEEP

768:cD+1VnooiH/2gcvDOlPmWeo6+tt5JcXClXMVyHueXo98U:vV9Y+g0DOEWeoBr5JcwXM0Oio3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4156	4032	WerFault.exe	60

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 4032	4988	rundll32.exe	60
PID 4988 wrote to memory of 4032	4988	rundll32.exe	60
PID 4988 wrote to memory of 4032	4988	rundll32.exe	60

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c9ab30ceb91310aafdd4860227880fa6fbcbf6f573e129df4d88d53e56b72230.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c9ab30ceb91310aafdd4860227880fa6fbcbf6f573e129df4d88d53e56b72230.dll,#1
  2⤵
  PID:4032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 560
    3⤵
    - Program crash
    PID:4156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4032 -ip 4032
1⤵
PID:3992