6ceb5978d6fcbf4592b788b7253e25370bcb23d9dd70d57fc14644d1b8b129dc

Analysis

max time kernel
115s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 13:50

Target

6ceb5978d6fcbf4592b788b7253e25370bcb23d9dd70d57fc14644d1b8b129dc.dll
Size

72KB
MD5

da27c46bc39612338195085c26811510
SHA1

85ac33b951b4bd543975b18f4eaccb9f9d4652a3
SHA256

6ceb5978d6fcbf4592b788b7253e25370bcb23d9dd70d57fc14644d1b8b129dc
SHA512

3da08bbc0aabb2077b262928fefda87276ac3c83c74be187e9ec08bd0040e13a6b74cebe9e41af5529cd9e2413dc443957afb33d005ce1b2da87c68e50ca9d60
SSDEEP

1536:UEdyxznQASyG6GKcxqzfibs0OHAvPKOK5zRzp1d:UEdgjQ16GK2qTibshCPKOK5zRzp1d

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4276	2040	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 2040	4040	rundll32.exe	81
PID 4040 wrote to memory of 2040	4040	rundll32.exe	81
PID 4040 wrote to memory of 2040	4040	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ceb5978d6fcbf4592b788b7253e25370bcb23d9dd70d57fc14644d1b8b129dc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ceb5978d6fcbf4592b788b7253e25370bcb23d9dd70d57fc14644d1b8b129dc.dll,#1
  2⤵
  PID:2040
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 668
    3⤵
    - Program crash
    PID:4276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2040 -ip 2040
1⤵
PID:4672