da663a50706e803dc46347618b89a1b66b9b8da3082202c12082797d145edb17

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 14:38

Target

da663a50706e803dc46347618b89a1b66b9b8da3082202c12082797d145edb17.dll
Size

295KB
MD5

0bfda194d800e50739f77d69a190484b
SHA1

ba3c36df977c4bbe9b02e9f8114df575004d5d44
SHA256

da663a50706e803dc46347618b89a1b66b9b8da3082202c12082797d145edb17
SHA512

33fa47da88c6803fb4895175ea1029fc3648917a79e216c4e2005da10e8c64741d3c7b19d8098c3ae760ca861dacd1f8e15b89ae78b9952580fa1fca4efdfd5a
SSDEEP

6144:86zFj6lI7uKDANzUnr2+D0xP34iU+4/hgOCcB+v+oaLABK+Hs:1zF2+7uKDmoZDhiU//eJMoaLAg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5100	3912	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 976 wrote to memory of 3912	976	rundll32.exe	83
PID 976 wrote to memory of 3912	976	rundll32.exe	83
PID 976 wrote to memory of 3912	976	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\da663a50706e803dc46347618b89a1b66b9b8da3082202c12082797d145edb17.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\da663a50706e803dc46347618b89a1b66b9b8da3082202c12082797d145edb17.dll,#1
  2⤵
  PID:3912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3912 -s 580
    3⤵
    - Program crash
    PID:5100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3912 -ip 3912
1⤵
PID:3036

memory/3912-133-0x0000000010000000-0x00000000100A2000-memory.dmp

Filesize
648KB

Download