d7ef2f14a36041a58e91e2dc66539f1e2250af6c3c2f6f62c539c193f6262953

Analysis

max time kernel
91s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 12:17

Target

d7ef2f14a36041a58e91e2dc66539f1e2250af6c3c2f6f62c539c193f6262953.dll
Size

160KB
MD5

13ab8a1c23b7946690631ac1fb667b51
SHA1

b7174cc234dc1bfb1ef05cbf73d5cec6d73ae16d
SHA256

d7ef2f14a36041a58e91e2dc66539f1e2250af6c3c2f6f62c539c193f6262953
SHA512

b16494274339716cfcca2fbed425e66fad516478a0acd39b69533c8ba7aed8176854c072731a83b818e0ac616919729c487cde09469f26100445c0bd41849cfa
SSDEEP

3072:kYpAxlaoK3MILMtZlEj1HAmsmI8nYgD5L5sbAnk2b6f:kYpOAtcILMtojtAcn/5L5nXb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2496	2692	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 2692	3212	rundll32.exe	82
PID 3212 wrote to memory of 2692	3212	rundll32.exe	82
PID 3212 wrote to memory of 2692	3212	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d7ef2f14a36041a58e91e2dc66539f1e2250af6c3c2f6f62c539c193f6262953.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d7ef2f14a36041a58e91e2dc66539f1e2250af6c3c2f6f62c539c193f6262953.dll,#1
  2⤵
  PID:2692
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 572
    3⤵
    - Program crash
    PID:2496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2692 -ip 2692
1⤵
PID:3684