eba3ab156455b5537e314c01b25787d8ba33498ae73b1939e2db356bf0fada1b

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 12:34

Target

eba3ab156455b5537e314c01b25787d8ba33498ae73b1939e2db356bf0fada1b.dll
Size

204KB
MD5

270192d919bc31d3c27b20b178614c20
SHA1

ac824bfafb4f4d9c669069535b8df4a0c4c89189
SHA256

eba3ab156455b5537e314c01b25787d8ba33498ae73b1939e2db356bf0fada1b
SHA512

056137cc88e1ead660dd73e92759b5957a520b13b287ba0c68034cc6e313186af9f1f7676c74654f8e804560104c198af7d2845a9a4d74fd1e00bd2d1eac9127
SSDEEP

3072:rTicIBf71WKzGdyDI+4LmhcuHJghbGrHkRalooMSscWRzPmg0qHRcO5VndxWNGew:+ppmupnkRKeWNGYO

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4304	3544	WerFault.exe	82
2032	3544	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 676 wrote to memory of 3544	676	rundll32.exe	82
PID 676 wrote to memory of 3544	676	rundll32.exe	82
PID 676 wrote to memory of 3544	676	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\eba3ab156455b5537e314c01b25787d8ba33498ae73b1939e2db356bf0fada1b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\eba3ab156455b5537e314c01b25787d8ba33498ae73b1939e2db356bf0fada1b.dll,#1
  2⤵
  PID:3544
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 592
    3⤵
    - Program crash
    PID:4304
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 800
    3⤵
    - Program crash
    PID:2032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3544 -ip 3544
1⤵
PID:4512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3544 -ip 3544
1⤵
PID:4968