2467e4faf699ddddfe678bb867bc89a4a629df3bfab30950c0ca3887053ea4b5

Analysis

max time kernel
173s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 00:33

Target

2467e4faf699ddddfe678bb867bc89a4a629df3bfab30950c0ca3887053ea4b5.dll
Size

82KB
MD5

b3b57bd92f47fe4f5cfe508adb2baff1
SHA1

9a37aa9eddc2b3071bf266278c140af9a0b10d9c
SHA256

2467e4faf699ddddfe678bb867bc89a4a629df3bfab30950c0ca3887053ea4b5
SHA512

447f92fc3dde24f902c0f3281d505330590ce6cf6d3654ffc049269a7bec7b2cc0d1bca46a32e3f82ac5ebde5973088badbb71dc343fc4ba6b2f17407367e6da
SSDEEP

1536:1W8DV3YrtryLNKiiju8L8cwEMfrw0SXVqB4qpEJbr:FV36tryLciiK8L8rEurw0kqB4qpEl

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3432	1468	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 1468	960	rundll32.exe	82
PID 960 wrote to memory of 1468	960	rundll32.exe	82
PID 960 wrote to memory of 1468	960	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2467e4faf699ddddfe678bb867bc89a4a629df3bfab30950c0ca3887053ea4b5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2467e4faf699ddddfe678bb867bc89a4a629df3bfab30950c0ca3887053ea4b5.dll,#1
  2⤵
  PID:1468
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 632
    3⤵
    - Program crash
    PID:3432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1468 -ip 1468
1⤵
PID:2804