6ea427d60dd0e7de38f8577ac75ce1138c73d9f903a1f08aeed7cefaeb8f3ade

Analysis

max time kernel
139s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 18:09

Target

6ea427d60dd0e7de38f8577ac75ce1138c73d9f903a1f08aeed7cefaeb8f3ade.dll
Size

160KB
MD5

e5a9bca06714ee76211157421a4da570
SHA1

6ab3482db06e4020f788831d4212cbe2e35573ff
SHA256

6ea427d60dd0e7de38f8577ac75ce1138c73d9f903a1f08aeed7cefaeb8f3ade
SHA512

5f99bc1edb11ed4d29fd7597d6a7303aa7893c7fc0ff1ed622107c752ec39d37986b46a0e2fea369f15c9d02efa75391c0a09aebeb4727a0f1b0e8340c591e33
SSDEEP

3072:xuhE6zRkHRcgnS892mMcYmxOHr1u/9av/CO15Y:xuh6RcDk8zlAO/C5

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4644	3472	WerFault.exe	80
4004	3472	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 3472	3828	rundll32.exe	80
PID 3828 wrote to memory of 3472	3828	rundll32.exe	80
PID 3828 wrote to memory of 3472	3828	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ea427d60dd0e7de38f8577ac75ce1138c73d9f903a1f08aeed7cefaeb8f3ade.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ea427d60dd0e7de38f8577ac75ce1138c73d9f903a1f08aeed7cefaeb8f3ade.dll,#1
  2⤵
  PID:3472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 544
    3⤵
    - Program crash
    PID:4644
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 844
    3⤵
    - Program crash
    PID:4004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3472 -ip 3472
1⤵
PID:4724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3472 -ip 3472
1⤵
PID:4052