97bfa334f4681f2f7f2291412a82915ce7d6b8467e0978ca44ffc1ee09e801dc

Analysis

max time kernel
184s
max time network
196s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 16:51

Target

97bfa334f4681f2f7f2291412a82915ce7d6b8467e0978ca44ffc1ee09e801dc.dll
Size

168KB
MD5

22d68e7f16624f1b1002554c743ee3d6
SHA1

7eec3e46e24429c668ff324908d54cc93d7bb86e
SHA256

97bfa334f4681f2f7f2291412a82915ce7d6b8467e0978ca44ffc1ee09e801dc
SHA512

82b016df5c139de437fd6491cea21dd2624e41154aac6f4cfcca3454cff4915e092cb47228f75d68c40e12df03e664b75e32493e3f181f4a002867af6c6e4fa0
SSDEEP

3072:/2ZfdD02C02/CiwlUK0TWZwEbup5ugY8Us1b+nLKI5jFflkmgc2xtn:g02C5CiwuywEYun/rneI55fumC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5012	2720	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 2720	2524	rundll32.exe	79
PID 2524 wrote to memory of 2720	2524	rundll32.exe	79
PID 2524 wrote to memory of 2720	2524	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\97bfa334f4681f2f7f2291412a82915ce7d6b8467e0978ca44ffc1ee09e801dc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\97bfa334f4681f2f7f2291412a82915ce7d6b8467e0978ca44ffc1ee09e801dc.dll,#1
  2⤵
  PID:2720
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 580
    3⤵
    - Program crash
    PID:5012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2720 -ip 2720
1⤵
PID:5052