b78c1301d570c81585e84c1b387c2343090ad75f4fe638dd1f3e401f5cfb57cb

Analysis

max time kernel
165s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 06:43

Target
b78c1301d570c81585e84c1b387c2343090ad75f4fe638dd1f3e401f5cfb57cb.dll
Size 120KB
Sample221203-hha6jsch53
SHA256 b78c1301d570c81585e84c1b387c2343090ad75f4fe638dd1f3e401f5cfb57cb
MD5 378c10d430650d3119f42cf6fd619a17
SHA1 11a056c83b54a875ab424f29e4080bcdff5d422a
SHA512 1420209d03ad9e3a2297b0dae99325dd62dfa37872e3ffa6f5567c6701d7a0b0565a46d286a39119e0b4fe98a1a8bfbef590901a26ffb9e3c39134a74ed50544
SSDEEP 1536:5DK0mhZgUrHVZveT6lHAc9DXqQEuJVgY9+b2ae2lIKJg/lollbsEAC4:5YVZmT6T6QEuJOY9YTeiIKylMlbs04
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3916	4836	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 4836	1892	rundll32.exe	81
PID 1892 wrote to memory of 4836	1892	rundll32.exe	81
PID 1892 wrote to memory of 4836	1892	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b78c1301d570c81585e84c1b387c2343090ad75f4fe638dd1f3e401f5cfb57cb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b78c1301d570c81585e84c1b387c2343090ad75f4fe638dd1f3e401f5cfb57cb.dll,#1
  2⤵
  PID:4836
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 636
    3⤵
    - Program crash
    PID:3916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4836 -ip 4836
1⤵
PID:4224