9b71cb75172cb8945909e4cde4e8e937e7176d9bd95d3c515e23dd1bc40b3696

Analysis

max time kernel
151s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 18:43

Target

9b71cb75172cb8945909e4cde4e8e937e7176d9bd95d3c515e23dd1bc40b3696.dll
Size

7KB
MD5

cab50ac4e5ca4ce047b3432a2c6192f0
SHA1

d8f090974046cd870748e246a63e2389c60bbc63
SHA256

9b71cb75172cb8945909e4cde4e8e937e7176d9bd95d3c515e23dd1bc40b3696
SHA512

8ffc7e4209fcf07c46e95bc4615e9bf32d7f4a631a646e28a7e5fb4c7324c0309b8c82685a7b067cc454d1ab3a272614161a76c250738d092d8b61da79a5ed23
SSDEEP

96:eQGiVnlT+cwazAIVI1nmLbEIjc5ikVlLkVLucw3DhDPyJz2AFp+VDzrM1ECnIxZn:eQNTsNI+jkpucw3DZBAa5WxI706ptB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1132	1408	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 1408	1952	rundll32.exe	83
PID 1952 wrote to memory of 1408	1952	rundll32.exe	83
PID 1952 wrote to memory of 1408	1952	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9b71cb75172cb8945909e4cde4e8e937e7176d9bd95d3c515e23dd1bc40b3696.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9b71cb75172cb8945909e4cde4e8e937e7176d9bd95d3c515e23dd1bc40b3696.dll,#1
  2⤵
  PID:1408
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 236
    3⤵
    - Program crash
    PID:1132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1408 -ip 1408
1⤵
PID:2420