72c360444f50f7b6d53d54f1a57e3544c65b2cc3b7fae5db839f7931f69e3838

Analysis

max time kernel
122s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 09:07

Target

72c360444f50f7b6d53d54f1a57e3544c65b2cc3b7fae5db839f7931f69e3838.dll
Size

150KB
MD5

aca55b39a10b64d471f7a742ecee0a70
SHA1

e82511d3fde5b9b81b545b0bbadf533ce1c8b72a
SHA256

72c360444f50f7b6d53d54f1a57e3544c65b2cc3b7fae5db839f7931f69e3838
SHA512

df7ccee3439629a328607df757568b1886aeb734b1402c3af23e5f8e8ce8477bfc8f6a3c6085b9292b48ad3cfc629e1e1789de406ef6172da5a2b7740e6fc24f
SSDEEP

3072:suhE6zRkA1syAdo7J8D56D/eKgSTdhQOSljmCp8wt/:suh/1ReD56KKgSJhQL9d/

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3680	2260	WerFault.exe	64
4836	2260	WerFault.exe	64

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2260	3068	rundll32.exe	64
PID 3068 wrote to memory of 2260	3068	rundll32.exe	64
PID 3068 wrote to memory of 2260	3068	rundll32.exe	64

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\72c360444f50f7b6d53d54f1a57e3544c65b2cc3b7fae5db839f7931f69e3838.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\72c360444f50f7b6d53d54f1a57e3544c65b2cc3b7fae5db839f7931f69e3838.dll,#1
  2⤵
  PID:2260
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 544
    3⤵
    - Program crash
    PID:3680
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 804
    3⤵
    - Program crash
    PID:4836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2260 -ip 2260
1⤵
PID:1532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2260 -ip 2260
1⤵
PID:3508