c99ef5f6e3d7f3d1d69aab8384636e91932532cd6fe5f6519e1a084fbee5bea6

Analysis

max time kernel
230s
max time network
275s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 05:58

Target

c99ef5f6e3d7f3d1d69aab8384636e91932532cd6fe5f6519e1a084fbee5bea6.dll
Size

127KB
MD5

3f355e121f107536942d9fee6825e9f3
SHA1

bc7a302203ec2145e0360b9b33b176214e77ed13
SHA256

c99ef5f6e3d7f3d1d69aab8384636e91932532cd6fe5f6519e1a084fbee5bea6
SHA512

da4ddd983ccbd578e930b009904d4338bf5ccd9a5b188aeb37b5e1e1f4e78ce5f556901181a3a76c2424f0bb3ecd434cccb711ea30ba7bdb4506cac8e26f85ea
SSDEEP

3072:lcg1l8nyU+jHgEUfJ458M8BBM3/4fVeVtk0mCFz9hJHky0KMMiU1m9:ugYyHH9Y0QNeVt1mCFz9bky0KNP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 1852	4084	rundll32.exe	80
PID 4084 wrote to memory of 1852	4084	rundll32.exe	80
PID 4084 wrote to memory of 1852	4084	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c99ef5f6e3d7f3d1d69aab8384636e91932532cd6fe5f6519e1a084fbee5bea6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c99ef5f6e3d7f3d1d69aab8384636e91932532cd6fe5f6519e1a084fbee5bea6.dll,#1
  2⤵
  PID:1852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1852 -ip 1852
1⤵
PID:2844