e4b787c7906dcbbd14991a2c9374f874376ddc97173f45d4670529d8d029c0bf

Analysis

max time kernel
199s
max time network
203s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 09:06

Target

e4b787c7906dcbbd14991a2c9374f874376ddc97173f45d4670529d8d029c0bf.dll
Size

169KB
MD5

64e66dd3c78935320140f0dbd372f790
SHA1

eb0eaf09192aba8957eced41c1a6c2f9b7404947
SHA256

e4b787c7906dcbbd14991a2c9374f874376ddc97173f45d4670529d8d029c0bf
SHA512

891b4a30ed9ce7787e30dc5535cb948aca58703d06c5de3872f2d13f24d4b70e7123eb61b9e3f261a145fad7c1ac2fb9a49e2173ab3b04ecadf6e4eb35526e57
SSDEEP

3072:vuhE6zRkaGnKR8++IN25UvVJbSnDTT7Yvjb5y6UNfvyp+4zK5EEsx:vuhfGn8+u25EV1CT0KfvyAji

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3244	3828	WerFault.exe	83
3260	3828	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 3828	2040	rundll32.exe	83
PID 2040 wrote to memory of 3828	2040	rundll32.exe	83
PID 2040 wrote to memory of 3828	2040	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e4b787c7906dcbbd14991a2c9374f874376ddc97173f45d4670529d8d029c0bf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e4b787c7906dcbbd14991a2c9374f874376ddc97173f45d4670529d8d029c0bf.dll,#1
  2⤵
  PID:3828
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 544
    3⤵
    - Program crash
    PID:3244
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 828
    3⤵
    - Program crash
    PID:3260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3828 -ip 3828
1⤵
PID:3400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3828 -ip 3828
1⤵
PID:1780