eeb19a735f5cd9161adb01f8badb85573f75d1a6a5446657137750eb65ba54ba

Analysis

max time kernel
201s
max time network
206s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 12:13

Target

eeb19a735f5cd9161adb01f8badb85573f75d1a6a5446657137750eb65ba54ba.dll
Size

32KB
MD5

64d7540b779ad63806a1d0e828038430
SHA1

9f0b265530996d080ed83359bd80201ce0639a54
SHA256

eeb19a735f5cd9161adb01f8badb85573f75d1a6a5446657137750eb65ba54ba
SHA512

361536b09bcfb3ecc4d439d93e1759f21ee113d5c395dd329da3982e7fa63dd089a300602e4313ad77860a65e2ba27e5c826a26226f7ac579e0516f10201650b
SSDEEP

384:i/pJuzg3dzNCo5Gi2a5V1dZgeQqghAEc9F+tnu6EDHJIg1/NC3vU2ZEq8A2L9GE:iLu85nZd+e/gh0OnTEDo3vUsC3

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3192	1980	WerFault.exe	82
2028	1980	WerFault.exe	82

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 1980	1420	rundll32.exe	82
PID 1420 wrote to memory of 1980	1420	rundll32.exe	82
PID 1420 wrote to memory of 1980	1420	rundll32.exe	82
PID 1980 wrote to memory of 3192	1980	rundll32.exe	86
PID 1980 wrote to memory of 3192	1980	rundll32.exe	86
PID 1980 wrote to memory of 3192	1980	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\eeb19a735f5cd9161adb01f8badb85573f75d1a6a5446657137750eb65ba54ba.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\eeb19a735f5cd9161adb01f8badb85573f75d1a6a5446657137750eb65ba54ba.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 600
    3⤵
    - Program crash
    PID:3192
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 600
    3⤵
    - Program crash
    PID:2028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 1980 -ip 1980
1⤵
PID:1600