d19c7f3246e0c6af2368416b1dc92ecd0fdb5145275e0818a2353d8e55d15491

Analysis

max time kernel
91s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 04:17

Target

d19c7f3246e0c6af2368416b1dc92ecd0fdb5145275e0818a2353d8e55d15491.dll
Size

268KB
MD5

56ab6b39fef2ba1201b90186d88017cf
SHA1

37b3e5b876905fc3a5528899fbdafa05c6b15234
SHA256

d19c7f3246e0c6af2368416b1dc92ecd0fdb5145275e0818a2353d8e55d15491
SHA512

57dfc8bea178b50ed4787daf4311418973048ffcdcb6474f660614808eb58261137f9f5ce63b76cad12e90cc3544066c271ffdfc162c0e4cff89f4be96a11c03
SSDEEP

6144:LlNtmNe53rwSoV6Ict9tcKuhRyipeeJuX4G0:5yNErwSoV6nt96Ku3tJa4G0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5096	2524	WerFault.exe	76

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 2524	1692	rundll32.exe	76
PID 1692 wrote to memory of 2524	1692	rundll32.exe	76
PID 1692 wrote to memory of 2524	1692	rundll32.exe	76

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d19c7f3246e0c6af2368416b1dc92ecd0fdb5145275e0818a2353d8e55d15491.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d19c7f3246e0c6af2368416b1dc92ecd0fdb5145275e0818a2353d8e55d15491.dll,#1
  2⤵
  PID:2524
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 572
    3⤵
    - Program crash
    PID:5096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2524 -ip 2524
1⤵
PID:4584