b54825ba69c46709ad675558cb44e2af6d81e493037167909eb0e49c0b3e2a67

Analysis

max time kernel
90s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 14:49

Target

b54825ba69c46709ad675558cb44e2af6d81e493037167909eb0e49c0b3e2a67.dll
Size

358KB
MD5

052d379eeab0d76435d291aa974635af
SHA1

7832dbf4a86a1565c26a8c7bbc59e5ee4aa2ceb3
SHA256

b54825ba69c46709ad675558cb44e2af6d81e493037167909eb0e49c0b3e2a67
SHA512

19ae788c3704edda649660454114ee1fe078c944ee2ef441eb11debcbaaaecea9384abbf964610b8ed723dc7531f164c0621571e1b1fddde1325b440faa3bb18
SSDEEP

6144:UYo7Y+Ou/fvZ2R61kppOW3/PmoATjhGkQYqd/a0lrUNcbr4deniOn:87NZ/fvZIp3P+ZZiYGlrecb8dei

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
844	3044	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 3044	848	rundll32.exe	82
PID 848 wrote to memory of 3044	848	rundll32.exe	82
PID 848 wrote to memory of 3044	848	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b54825ba69c46709ad675558cb44e2af6d81e493037167909eb0e49c0b3e2a67.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b54825ba69c46709ad675558cb44e2af6d81e493037167909eb0e49c0b3e2a67.dll,#1
  2⤵
  PID:3044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 580
    3⤵
    - Program crash
    PID:844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 3044 -ip 3044
1⤵
PID:1296