b31ff5244d3d508e795622471bb25b91167de7861448153b01ccc6eae629330f

Analysis

max time kernel
195s
max time network
206s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 07:05

Target

b31ff5244d3d508e795622471bb25b91167de7861448153b01ccc6eae629330f.dll
Size

440KB
MD5

8d9229bd4f23f6305b2e155d5ac3084f
SHA1

6ab6ea99f4aa38b62d79d7931d4d9ad9ab76e3ed
SHA256

b31ff5244d3d508e795622471bb25b91167de7861448153b01ccc6eae629330f
SHA512

fb74b714cc9599bbb60fa45afdd8de3feb2e7f91870b7e0e84ad5f19cd2164d90cc75c41fda111ba72d9a17ac231ece8db0b9772213e8ab0bfe5f3a76e5b9ff5
SSDEEP

12288:NcnQ9PUA1PbMfjHkOFTsrjcCBJ0msTz8H:qnasAVbMfjPOw0kTIH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4316	4684	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 4684	4584	rundll32.exe	82
PID 4584 wrote to memory of 4684	4584	rundll32.exe	82
PID 4584 wrote to memory of 4684	4584	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b31ff5244d3d508e795622471bb25b91167de7861448153b01ccc6eae629330f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b31ff5244d3d508e795622471bb25b91167de7861448153b01ccc6eae629330f.dll,#1
  2⤵
  PID:4684
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 584
    3⤵
    - Program crash
    PID:4316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4684 -ip 4684
1⤵
PID:1860