1fd44f53bae4369a177295b93322f331112e67f7357e07ceef475a52f34918a0

Analysis

max time kernel
307s
max time network
379s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 03:13

Target

1fd44f53bae4369a177295b93322f331112e67f7357e07ceef475a52f34918a0.dll
Size

7.4MB
MD5

ad0541f1a98fec199c33580c11bebb50
SHA1

74114e04912f606b98aca27e5a57f46236f61bd2
SHA256

1fd44f53bae4369a177295b93322f331112e67f7357e07ceef475a52f34918a0
SHA512

aee734d5487c071e8b64c59f4f6e5fd819c20112682888ebc0671eefe325aa0c254a433b822b0ca558c662f1d9fb4d212616c3922eca50329a35caae347e5343
SSDEEP

98304:Y2F/rBjd+nbf5ewT0f+2Ck7XbJUjC3AMDb7Kz/Ec0gD6aZaQhB104uwoPWvY:xbmbhewo22RXbajYHHuL0gjBhBIWvY

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5044 4412 WerFault.exe rundll32.exe

pid	pid_target	process	target process
5044	4412	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4668 wrote to memory of 4412	4668	rundll32.exe	rundll32.exe
PID 4668 wrote to memory of 4412	4668	rundll32.exe	rundll32.exe
PID 4668 wrote to memory of 4412	4668	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1fd44f53bae4369a177295b93322f331112e67f7357e07ceef475a52f34918a0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4668

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1fd44f53bae4369a177295b93322f331112e67f7357e07ceef475a52f34918a0.dll,#1
2⤵
PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 732
3⤵
- Program crash
PID:5044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 4412 -ip 4412
1⤵
PID:3624