b82720708c5943e5a36c8bdf184adc3199aba9847b7aa467b54044aa0ac11231

Analysis

max time kernel
175s
max time network
197s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 14:36

Target

b82720708c5943e5a36c8bdf184adc3199aba9847b7aa467b54044aa0ac11231.dll
Size

76KB
MD5

8977916db32c5e0a96cc86cc718c7c47
SHA1

be584196276859f743fa504d1f12aa099f0de321
SHA256

b82720708c5943e5a36c8bdf184adc3199aba9847b7aa467b54044aa0ac11231
SHA512

01d3d260f491de9d7c8663d46fd62a21a76805acfada103955fbe7d55141d1a6276047e3f1d978baa37bc0a30f47ac19a391d129b19b5409ad6769045212167b
SSDEEP

768:uMblCmo9Cg1jKd3Ss+LslT7RtKJVRjT/Uu1pqK0uPyE9iB9nybhfpuSOFZ5bbsru:uuQmoIg9WPRtUPjT8oqK0unhwzpsC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4032	1496	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 1496	4248	rundll32.exe	82
PID 4248 wrote to memory of 1496	4248	rundll32.exe	82
PID 4248 wrote to memory of 1496	4248	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b82720708c5943e5a36c8bdf184adc3199aba9847b7aa467b54044aa0ac11231.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b82720708c5943e5a36c8bdf184adc3199aba9847b7aa467b54044aa0ac11231.dll,#1
  2⤵
  PID:1496
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1496 -s 580
    3⤵
    - Program crash
    PID:4032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1496 -ip 1496
1⤵
PID:1916