acb2aa862a667a4e51d1030cfe0b00b5db8d199b3fbd2cf35391b0ffb2a92f2c

Analysis

max time kernel
229s
max time network
242s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 16:47

Target

acb2aa862a667a4e51d1030cfe0b00b5db8d199b3fbd2cf35391b0ffb2a92f2c.dll
Size

173KB
MD5

f39252cefe7d334d80b7c3935d17420a
SHA1

e5f07cac8da5772e6d4b3f67c893ad88ad688b9e
SHA256

acb2aa862a667a4e51d1030cfe0b00b5db8d199b3fbd2cf35391b0ffb2a92f2c
SHA512

02e0c208f8f2edb91003ab4c3f162c0f7d3969627d5cc4b8192a1505fc9e77701b03444f9bd81e043242d5f8980fab54189c6d363e7507d10154826c3eb8c424
SSDEEP

3072:XeZeKyJbvN/dSqA2xReFURUdXE3eXuOfO1LJW4LTkyagDic9/baswYzL/m18p:XeZby9N1SoeGCdXErAO1RLLWswYz3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3028	3720	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 3720	3664	rundll32.exe	82
PID 3664 wrote to memory of 3720	3664	rundll32.exe	82
PID 3664 wrote to memory of 3720	3664	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\acb2aa862a667a4e51d1030cfe0b00b5db8d199b3fbd2cf35391b0ffb2a92f2c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\acb2aa862a667a4e51d1030cfe0b00b5db8d199b3fbd2cf35391b0ffb2a92f2c.dll,#1
  2⤵
  PID:3720
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 584
    3⤵
    - Program crash
    PID:3028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3720 -ip 3720
1⤵
PID:4668