9d1f5dfa237a1b67da0a1cf9e4e3c4aa04b40a08ad57c1c6849eafb76f0432ee

Analysis

max time kernel
141s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 06:17

Target

9d1f5dfa237a1b67da0a1cf9e4e3c4aa04b40a08ad57c1c6849eafb76f0432ee.dll
Size

35KB
MD5

378e676fd674bb656653d5a920130299
SHA1

643e985930d9972d8deea7349bf5b450b3676638
SHA256

9d1f5dfa237a1b67da0a1cf9e4e3c4aa04b40a08ad57c1c6849eafb76f0432ee
SHA512

459c3848ff5adbbd6a3851435f90266f29c71b09072cff0e393866b0f2f2bc4f554ab689fa0e27ccb103fd5f9b72d054e50b8208b151fbd5cdc4e27d1350b19c
SSDEEP

384:lGL/VoTd0vqxwLnt2nmlIOuyLLegnoIo9tHTmeDoQOkjCdojdfsYtfSL:CVoTdFeLt2ouiegoIo9tzToQqdoBfu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5076	4808	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 4808	2584	rundll32.exe	83
PID 2584 wrote to memory of 4808	2584	rundll32.exe	83
PID 2584 wrote to memory of 4808	2584	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9d1f5dfa237a1b67da0a1cf9e4e3c4aa04b40a08ad57c1c6849eafb76f0432ee.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9d1f5dfa237a1b67da0a1cf9e4e3c4aa04b40a08ad57c1c6849eafb76f0432ee.dll,#1
  2⤵
  PID:4808
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 600
    3⤵
    - Program crash
    PID:5076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4808 -ip 4808
1⤵
PID:5024