f0b20525d97e39bb9f598cf2fb33fa75c8e4e302c4afc0fa2bddc3fa035210f5

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 11:25

Target

f0b20525d97e39bb9f598cf2fb33fa75c8e4e302c4afc0fa2bddc3fa035210f5.dll
Size

216KB
MD5

3e208db3e116a7b228747f420fa95ce1
SHA1

b848d89e79aec8763a841090c0536339c657dd5f
SHA256

f0b20525d97e39bb9f598cf2fb33fa75c8e4e302c4afc0fa2bddc3fa035210f5
SHA512

73ba879d6303e6b981385f4679c408ddd80d43d99da8a470be858fc173808d8e1d87271e613b5a9500841b9ddcc0b2da6b4814aa470868472bf62c2f617b3475
SSDEEP

3072:emnvIvjsmmhclUfrECdq6pamg3srY6H5GTfrFFzTUN+AtgUT5:qvon5bQmeeE5FzTk8y

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4308	4200	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 4200	4900	rundll32.exe	82
PID 4900 wrote to memory of 4200	4900	rundll32.exe	82
PID 4900 wrote to memory of 4200	4900	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f0b20525d97e39bb9f598cf2fb33fa75c8e4e302c4afc0fa2bddc3fa035210f5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f0b20525d97e39bb9f598cf2fb33fa75c8e4e302c4afc0fa2bddc3fa035210f5.dll,#1
  2⤵
  PID:4200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4200 -s 592
    3⤵
    - Program crash
    PID:4308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4200 -ip 4200
1⤵
PID:4724