8ec3146bbca9855b3a31227bc3a30e64b7a0f3e2e22748f916e45fb5d23d160a

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 00:44

Target

8ec3146bbca9855b3a31227bc3a30e64b7a0f3e2e22748f916e45fb5d23d160a.dll
Size

22KB
MD5

04596d9d31d3f24ee3923c377d1f63f8
SHA1

eae0b66b275b8c5a13bee5f00717bb1627057488
SHA256

8ec3146bbca9855b3a31227bc3a30e64b7a0f3e2e22748f916e45fb5d23d160a
SHA512

a4a7293952e7ee019fed9ce7894140eefaf1a51e34224b67bc8f8c616eee167c61ed4d98ba814a6cf4e2efc82605e200a4bc94b8ba674e12e5443f339219daed
SSDEEP

384:eQ6AAKaXMJhYOJmw/pdmGdj23aix9xmxzAA0uu6g87jK:96AARXMJh7IJfxDmZAA7u6372

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2276	1140	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 1140	4572	rundll32.exe	79
PID 4572 wrote to memory of 1140	4572	rundll32.exe	79
PID 4572 wrote to memory of 1140	4572	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8ec3146bbca9855b3a31227bc3a30e64b7a0f3e2e22748f916e45fb5d23d160a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8ec3146bbca9855b3a31227bc3a30e64b7a0f3e2e22748f916e45fb5d23d160a.dll,#1
  2⤵
  PID:1140
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 552
    3⤵
    - Program crash
    PID:2276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1140 -ip 1140
1⤵
PID:1532