cabc6356eb82a7bff8bcf73175a24058a878f41e60b5ca4c7152d427487d3104

Analysis

max time kernel
180s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 05:51

Target

cabc6356eb82a7bff8bcf73175a24058a878f41e60b5ca4c7152d427487d3104.dll
Size

920KB
MD5

97973a2895585289a9b8016ec2da7a80
SHA1

a7b92f277e2191dd87feb32ff070eed590b073c9
SHA256

cabc6356eb82a7bff8bcf73175a24058a878f41e60b5ca4c7152d427487d3104
SHA512

51b9dfb7c856e3dc332ef96478a02e68f7d214d9222516a8673c5365271ee0315794bbdbde34611dbfbcf3fc6138c488cda52ec8f523d8e8d60d9d1dd835e097
SSDEEP

12288:DFN2OEmVTCCrfei0ENkX5v4XpaO6AeAcAR2TT+yn:DFN2ODVWCbaE8QXEO6AeATR2vTn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3056	4800	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 4800	4840	rundll32.exe	79
PID 4840 wrote to memory of 4800	4840	rundll32.exe	79
PID 4840 wrote to memory of 4800	4840	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cabc6356eb82a7bff8bcf73175a24058a878f41e60b5ca4c7152d427487d3104.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cabc6356eb82a7bff8bcf73175a24058a878f41e60b5ca4c7152d427487d3104.dll,#1
  2⤵
  PID:4800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 620
    3⤵
    - Program crash
    PID:3056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4800 -ip 4800
1⤵
PID:440