f76ac320b91b088cd11afec70b6eb082e7b25ea85c31799a5aa8c21598fffa44

Analysis

max time kernel
172s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 06:33

Target

f76ac320b91b088cd11afec70b6eb082e7b25ea85c31799a5aa8c21598fffa44.dll
Size

106KB
MD5

1a9093e7387023299e61fddeb87a0583
SHA1

30d3a4e43528c39f732bbac3357818d848b883d0
SHA256

f76ac320b91b088cd11afec70b6eb082e7b25ea85c31799a5aa8c21598fffa44
SHA512

774378d02638c9f7bb177d49c876a079bb0b1d1b60ce0b5d65ae2369e897380a2ab60d3f09b4b6f12d45bdf9d4967185d850ff1996e7255cb838d55136065dea
SSDEEP

1536:fN8ptcpzTbgXaEGQVil7Get9WGqT+k50AFnVwA8JPG1hS:aKpTbgXrGIUV3WGtA8JPG7

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1508	3056	WerFault.exe	79
1712	3056	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 3056	4300	rundll32.exe	79
PID 4300 wrote to memory of 3056	4300	rundll32.exe	79
PID 4300 wrote to memory of 3056	4300	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f76ac320b91b088cd11afec70b6eb082e7b25ea85c31799a5aa8c21598fffa44.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f76ac320b91b088cd11afec70b6eb082e7b25ea85c31799a5aa8c21598fffa44.dll,#1
  2⤵
  PID:3056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 588
    3⤵
    - Program crash
    PID:1508
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 796
    3⤵
    - Program crash
    PID:1712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3056 -ip 3056
1⤵
PID:1064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 3056 -ip 3056
1⤵
PID:2220