ac12ab39e1945898c76a90c86014062753a8edaf6cb1092704ed49896f892cd5

Analysis

max time kernel
166s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 00:05

Target

ac12ab39e1945898c76a90c86014062753a8edaf6cb1092704ed49896f892cd5.dll
Size

205KB
MD5

e0458d54a2188d6a2e08b89f76885770
SHA1

39ef63b6446ddd98b7e37778d3810d2835a4287f
SHA256

ac12ab39e1945898c76a90c86014062753a8edaf6cb1092704ed49896f892cd5
SHA512

d1ef6fcb41c78178951a47d7361eb0a03c5a5561d49600a698f9497bd7c893ed0b8690c61e4e4479b450a208c8d916865328c34a4ddb7db97c146331df4ec340
SSDEEP

3072:QVfPm9TjhU3FyUHFutaTdddfCLZEREXIuIzgyZbfG4Gfz:cfPTzwtaTdPq9FYz5fGf

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1548	1568	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 1568	1536	rundll32.exe	82
PID 1536 wrote to memory of 1568	1536	rundll32.exe	82
PID 1536 wrote to memory of 1568	1536	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac12ab39e1945898c76a90c86014062753a8edaf6cb1092704ed49896f892cd5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac12ab39e1945898c76a90c86014062753a8edaf6cb1092704ed49896f892cd5.dll,#1
  2⤵
  PID:1568
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 624
    3⤵
    - Program crash
    PID:1548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1568 -ip 1568
1⤵
PID:1532

memory/1568-133-0x0000000002150000-0x0000000002162000-memory.dmp

Filesize
72KB

Download