96e5a91ac0b32403f2e0eb8c346c89ac546b7b7de73a42c32e4ccb237e46151c

Analysis

max time kernel
92s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 12:23

Target

96e5a91ac0b32403f2e0eb8c346c89ac546b7b7de73a42c32e4ccb237e46151c.dll
Size

293KB
MD5

5bcfe220e257beeafd8504c88f7aa44b
SHA1

a21f80413bcd3134386651d338a20382795bd404
SHA256

96e5a91ac0b32403f2e0eb8c346c89ac546b7b7de73a42c32e4ccb237e46151c
SHA512

0f14f688b882016258bed5b037f6ba00cde9498078e16a859464f74daf2f9e7c28fcf0429253b11669a04de9359639a5db8d33b3e5a33d07a61b6e125ba6333e
SSDEEP

6144:hQ4drDn2uYQ+FTlxnrQdpDWNucyConbNCEki0UKNP:VDn2uYPF7QDAyCGNxkRr

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4344	4740	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 4740	4572	rundll32.exe	80
PID 4572 wrote to memory of 4740	4572	rundll32.exe	80
PID 4572 wrote to memory of 4740	4572	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\96e5a91ac0b32403f2e0eb8c346c89ac546b7b7de73a42c32e4ccb237e46151c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\96e5a91ac0b32403f2e0eb8c346c89ac546b7b7de73a42c32e4ccb237e46151c.dll,#1
  2⤵
  PID:4740
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 580
    3⤵
    - Program crash
    PID:4344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4740 -ip 4740
1⤵
PID:2364