9a43010735fb5655194efa0ea54ec3df334e4d699e9e32b955a80e34c9521ca9

Analysis

max time kernel
194s
max time network
237s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 21:35

Target

9a43010735fb5655194efa0ea54ec3df334e4d699e9e32b955a80e34c9521ca9.dll
Size

43KB
MD5

80f0dbc9e0e6a18f56834c80f7cab4a4
SHA1

6654d06dde3645e7ec1a1d402999e946d1bb811b
SHA256

9a43010735fb5655194efa0ea54ec3df334e4d699e9e32b955a80e34c9521ca9
SHA512

127d92c498e64c8756508d617b80aaa568d3b744fba066e54418228993eb29b432e1ea33d22fbad966d7f2555d524ebca2f3454cc39565ad8836ba7cce6faeaa
SSDEEP

768:7mKRZOCROpT61mn1GbJY/JT2Ms3t+j/TNZCZf1siUANN4nUcTxs1suOPqApo9wH:7ftROpT61mneJY/JqZty/6UiUANJyDHZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3256	5008	WerFault.exe	78

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 5008	4676	rundll32.exe	78
PID 4676 wrote to memory of 5008	4676	rundll32.exe	78
PID 4676 wrote to memory of 5008	4676	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a43010735fb5655194efa0ea54ec3df334e4d699e9e32b955a80e34c9521ca9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a43010735fb5655194efa0ea54ec3df334e4d699e9e32b955a80e34c9521ca9.dll,#1
  2⤵
  PID:5008
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 560
    3⤵
    - Program crash
    PID:3256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5008 -ip 5008
1⤵
PID:4992