ffef6c25bd0509841819698cd1ccecd6e929cef0ac11468cc6bd7406f3400835

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 10:05

Target

ffef6c25bd0509841819698cd1ccecd6e929cef0ac11468cc6bd7406f3400835.dll
Size

132KB
MD5

a9e5d6c57c73816057e86bdc48f48947
SHA1

2225fcb23dadecd26df29ee7e0d23fe7f7d573f4
SHA256

ffef6c25bd0509841819698cd1ccecd6e929cef0ac11468cc6bd7406f3400835
SHA512

745896103ff17bf64f2734fefadd00fc6d454a893b78f1aba33fb1e654ca219accda6bbc473fa5ac0112b2e074f89a8603571968db0f9ba671cd87fff82e137c
SSDEEP

3072:yYH6RMZk+uFjwLjfzqyfY6eb3PZur/2Q3:yYoMwFjwfRfnm/Zur/2Q3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3208	4208	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 4208	2608	rundll32.exe	80
PID 2608 wrote to memory of 4208	2608	rundll32.exe	80
PID 2608 wrote to memory of 4208	2608	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffef6c25bd0509841819698cd1ccecd6e929cef0ac11468cc6bd7406f3400835.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffef6c25bd0509841819698cd1ccecd6e929cef0ac11468cc6bd7406f3400835.dll,#1
  2⤵
  PID:4208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4208 -s 664
    3⤵
    - Program crash
    PID:3208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4208 -ip 4208
1⤵
PID:1720