a5f57c85b6c00d54a8d47d55955cacc83d2d230dfdc4237d25393abc452408a1

Analysis

max time kernel
227s
max time network
262s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 10:00

Target

a5f57c85b6c00d54a8d47d55955cacc83d2d230dfdc4237d25393abc452408a1.dll
Size

288KB
MD5

d1930c49c7cdafd6f49e260e717113bb
SHA1

98f4fa928eac341dc145c0275f8c896bddeff382
SHA256

a5f57c85b6c00d54a8d47d55955cacc83d2d230dfdc4237d25393abc452408a1
SHA512

21b842ff8058b92b12cdf729f4a3230a44863c1fa73c740b8cc38fd81a798905983b30c28c602864278c4efeeb657578e0c9e59b17f58fa072d8f1a017346bb1
SSDEEP

3072:+osVnN+N/de+GOanW3dSMZlxtGMWX4/ETBftbnGDuLHG8LE+1zX:+oKkNU2a+/ZlnGMh/ETBlbGr8pX

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4420	3448	WerFault.exe	80
5032	3448	WerFault.exe	80

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 3448	4064	rundll32.exe	80
PID 4064 wrote to memory of 3448	4064	rundll32.exe	80
PID 4064 wrote to memory of 3448	4064	rundll32.exe	80
PID 3448 wrote to memory of 4420	3448	rundll32.exe	83
PID 3448 wrote to memory of 4420	3448	rundll32.exe	83
PID 3448 wrote to memory of 4420	3448	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a5f57c85b6c00d54a8d47d55955cacc83d2d230dfdc4237d25393abc452408a1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a5f57c85b6c00d54a8d47d55955cacc83d2d230dfdc4237d25393abc452408a1.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 612
    3⤵
    - Program crash
    PID:4420
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 612
    3⤵
    - Program crash
    PID:5032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3448 -ip 3448
1⤵
PID:4516