b8b09667fce880457560feeb18e4165109143a254a2c29edd6e2adfdca408852

Analysis

max time kernel
113s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 07:54

Target
b8b09667fce880457560feeb18e4165109143a254a2c29edd6e2adfdca408852.dll
Size 108KB
Sample221205-jrn97seb4s
SHA256 b8b09667fce880457560feeb18e4165109143a254a2c29edd6e2adfdca408852
MD5 500caf2f0638b431f85bc4931bf59460
SHA1 2815948f9005ec478e3fdf1c5a8eed944e8eafd0
SHA512 4ebf5c30f53f76784de1d4e9419fe4455cc73aef6b5e3905f8c109df5adc8009ab5924719a1b67ecc17e5f9c7c27a83b07b23c6f9f8259f89c9105bc1061dfb3
SSDEEP 3072:LY63560RZ+PjoOeBB83hzywh6JXRZgMBJfW4T:UaUS237gJBZgMBRTT
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5020	4912	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 4912	4284	rundll32.exe	79
PID 4284 wrote to memory of 4912	4284	rundll32.exe	79
PID 4284 wrote to memory of 4912	4284	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b8b09667fce880457560feeb18e4165109143a254a2c29edd6e2adfdca408852.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b8b09667fce880457560feeb18e4165109143a254a2c29edd6e2adfdca408852.dll,#1
  2⤵
  PID:4912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 616
    3⤵
    - Program crash
    PID:5020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 4912 -ip 4912
1⤵
PID:4960