c8433dc6d6bee313341edd44757d63e760452f5552ea0e10af4712a46bcbe1d9

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 17:52

Target

c8433dc6d6bee313341edd44757d63e760452f5552ea0e10af4712a46bcbe1d9.dll
Size

56KB
MD5

5c01cb6732ac8e090c34268565926d28
SHA1

137e7a226dad3035f5bd0e46841b6873b6cbec33
SHA256

c8433dc6d6bee313341edd44757d63e760452f5552ea0e10af4712a46bcbe1d9
SHA512

dc263fdbe05f07dd3bf147a0e226d3a020533345bbfbe04d96fabaa935e2321fc7648893d44d0088d01a51c3fdbc17a826906fac74eba52536876c868b2e04d8
SSDEEP

768:5KmvW6xaUjnHy6Qlyp+pEFNT5MsnnYhhL7DLXo9Dy8I:0mOwTnHyWp+Sb5NYL/o48

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2836	640	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 640	4972	rundll32.exe	80
PID 4972 wrote to memory of 640	4972	rundll32.exe	80
PID 4972 wrote to memory of 640	4972	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c8433dc6d6bee313341edd44757d63e760452f5552ea0e10af4712a46bcbe1d9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c8433dc6d6bee313341edd44757d63e760452f5552ea0e10af4712a46bcbe1d9.dll,#1
  2⤵
  PID:640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 560
    3⤵
    - Program crash
    PID:2836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 640 -ip 640
1⤵
PID:1220