95beb0b8efb79e4e2b20d00ec4c56c36e05c7444881cb32a88fdfa1a88bf14b1

Analysis

max time kernel
116s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 14:05

Target

95beb0b8efb79e4e2b20d00ec4c56c36e05c7444881cb32a88fdfa1a88bf14b1.dll
Size

541KB
MD5

0ef2c14ff6a252b5ef461fc9d388beef
SHA1

6a5ffcf8c01d5a38c6ab7ffe0f68b0cc118694c0
SHA256

95beb0b8efb79e4e2b20d00ec4c56c36e05c7444881cb32a88fdfa1a88bf14b1
SHA512

24acdd2dd17b7d70e4fb6245ab53ed3d3ea9afe06ada9a0f5d2a4dbcddbefa223116d3850f904f02bc4ba7e6f047a4db8032db6438e2e546153e87770af93871
SSDEEP

12288:Ibti02AjEqGnK+hi0nDzSgw5fMQ5/U9ykcjUUmbI23z9Ae5yw6cLCtyTnZ:3qljE3KuMGCgd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2432	5104	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 5104	4188	rundll32.exe	80
PID 4188 wrote to memory of 5104	4188	rundll32.exe	80
PID 4188 wrote to memory of 5104	4188	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\95beb0b8efb79e4e2b20d00ec4c56c36e05c7444881cb32a88fdfa1a88bf14b1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\95beb0b8efb79e4e2b20d00ec4c56c36e05c7444881cb32a88fdfa1a88bf14b1.dll,#1
  2⤵
  PID:5104
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 600
    3⤵
    - Program crash
    PID:2432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5104 -ip 5104
1⤵
PID:4140