848d522c619b0c73b20355275223fd72f515f3c6f5f76a06b8757dd4c2e062dd

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 20:38

Target

848d522c619b0c73b20355275223fd72f515f3c6f5f76a06b8757dd4c2e062dd.dll
Size

112KB
MD5

ab74a7e4f7065c581af54488bbfdfa38
SHA1

c8fdfa475f717a9413ebc518b128c91dfb1611ba
SHA256

848d522c619b0c73b20355275223fd72f515f3c6f5f76a06b8757dd4c2e062dd
SHA512

015ec1c583de9ce850c518bed7c70543d4014c48b73fe5cbca2424ef36fc6ddbf6caec2462014d0004a08187bb5d74c81cd43198d858d59e5653d327a7e62d0f
SSDEEP

3072:NfnU7Buu6poY4s3JebwVCEPCl4rGxckw:K7hs

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2260	2080	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 2080	4644	rundll32.exe	80
PID 4644 wrote to memory of 2080	4644	rundll32.exe	80
PID 4644 wrote to memory of 2080	4644	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\848d522c619b0c73b20355275223fd72f515f3c6f5f76a06b8757dd4c2e062dd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\848d522c619b0c73b20355275223fd72f515f3c6f5f76a06b8757dd4c2e062dd.dll,#1
  2⤵
  PID:2080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 600
    3⤵
    - Program crash
    PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2080 -ip 2080
1⤵
PID:3792