fe5086eba97035f0ebff8dfc2af6a294060bb02f0047f43b0a3d72546fe83437

Analysis

max time kernel
200s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 10:16

Target

fe5086eba97035f0ebff8dfc2af6a294060bb02f0047f43b0a3d72546fe83437.dll
Size

52KB
MD5

1aee6597c61112056e085fc06b3daa60
SHA1

269fe4eb65ec9bd5cea26200fbf645ae7f68e666
SHA256

fe5086eba97035f0ebff8dfc2af6a294060bb02f0047f43b0a3d72546fe83437
SHA512

6a53b128ac1353a260455a3505c7fd7f69a7d83c63dcfde9f103ac3e43b1f87c497c4ba660475a6477fb3d4c9a40e6cc9831f4521082a3110d62abc491c5044d
SSDEEP

768:lyOYs0Ci3T9qLkIB+0yM1/CWdoYqTjGa4EhRtIQ9hd+HPWVunTEDHA7wjca:lZzi34LkkV/RdoF7ecUHP7ER

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3688	204	WerFault.exe	83
4064	204	WerFault.exe	83

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 204	2312	rundll32.exe	83
PID 2312 wrote to memory of 204	2312	rundll32.exe	83
PID 2312 wrote to memory of 204	2312	rundll32.exe	83
PID 204 wrote to memory of 3688	204	rundll32.exe	85
PID 204 wrote to memory of 3688	204	rundll32.exe	85
PID 204 wrote to memory of 3688	204	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe5086eba97035f0ebff8dfc2af6a294060bb02f0047f43b0a3d72546fe83437.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe5086eba97035f0ebff8dfc2af6a294060bb02f0047f43b0a3d72546fe83437.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:204
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 204 -s 608
    3⤵
    - Program crash
    PID:3688
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 204 -s 608
    3⤵
    - Program crash
    PID:4064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 204 -ip 204
1⤵
PID:3100