ca7848cd0687c885205b604048f5c4dac65033672b6fe9e565ad063193ee9654

Analysis

max time kernel
176s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 05:53

Target
ca7848cd0687c885205b604048f5c4dac65033672b6fe9e565ad063193ee9654.dll
Size 204KB
Sample221205-gltavsbe36
SHA256 ca7848cd0687c885205b604048f5c4dac65033672b6fe9e565ad063193ee9654
MD5 dca621955f1055cc89c6756b12f00990
SHA1 7a05c318d58c5d33dba8a68347b7e78bf695cde9
SHA512 ea944354c9efb7e3651a0aabc204d5dd088095b32ead0e5cd9f1736b834b591596254c354a5248267d47e0c4c6f3e2c47c0155d8c9f046cd985168479bdc531a
SSDEEP 3072:4L4VDxk7xWamNdyDIRzHJc0nJ2VbWMk7V7wBkSqcmRlvmI0qHhcO5VHteGHzkswW:odJv0Jl7W84swYCa
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1244	4484	WerFault.exe	81
1804	4484	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 4484	4064	rundll32.exe	81
PID 4064 wrote to memory of 4484	4064	rundll32.exe	81
PID 4064 wrote to memory of 4484	4064	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca7848cd0687c885205b604048f5c4dac65033672b6fe9e565ad063193ee9654.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca7848cd0687c885205b604048f5c4dac65033672b6fe9e565ad063193ee9654.dll,#1
  2⤵
  PID:4484
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 592
    3⤵
    - Program crash
    PID:1244
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 780
    3⤵
    - Program crash
    PID:1804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4484 -ip 4484
1⤵
PID:3692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4484 -ip 4484
1⤵
PID:4312