c4c7c387f32e8377dc2a0caa233e0efb9894c0deda91af73e5a96a0c5f930fd6

Analysis

max time kernel
168s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 00:44

Target

c4c7c387f32e8377dc2a0caa233e0efb9894c0deda91af73e5a96a0c5f930fd6.dll
Size

18KB
MD5

f7d96ac1fd22f3ca9c1e8e3a57b38385
SHA1

9aa1f31ac9df4858c9d6767d01795a0357a0751e
SHA256

c4c7c387f32e8377dc2a0caa233e0efb9894c0deda91af73e5a96a0c5f930fd6
SHA512

c758413e132570c1b97e8d38e4684e65168cadd98383a7f99cefc31d14503b02f164c0e8f2d052133caca175b34cd72755a8cae1eea04108c768325cd9840b64
SSDEEP

384:SwAFumagyxDtZFnDuhGGP5nlDBWO3N7DdSILVBk0Ln8CjC7:Sw7magyTDuTJRw87DFLnYCG7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4240	4720	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 516 wrote to memory of 4720	516	rundll32.exe	79
PID 516 wrote to memory of 4720	516	rundll32.exe	79
PID 516 wrote to memory of 4720	516	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c4c7c387f32e8377dc2a0caa233e0efb9894c0deda91af73e5a96a0c5f930fd6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:516
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c4c7c387f32e8377dc2a0caa233e0efb9894c0deda91af73e5a96a0c5f930fd6.dll,#1
  2⤵
  PID:4720
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 552
    3⤵
    - Program crash
    PID:4240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4720 -ip 4720
1⤵
PID:3644