2fb7bca9431ab734da980b67e428e8e3a622ed51281daa7bdba76b552631b839

Analysis

max time kernel
133s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 15:17

Target

2fb7bca9431ab734da980b67e428e8e3a622ed51281daa7bdba76b552631b839.dll
Size

163KB
MD5

3b9bb732bebe7f6310f8b0132a86e950
SHA1

b47f27d414e0a93bd3640fab7ef2f6f6d335d109
SHA256

2fb7bca9431ab734da980b67e428e8e3a622ed51281daa7bdba76b552631b839
SHA512

0f6cd7e0058e88d7d20547b803fc8d3c92f37a91421140a78d49a623969f437d7d3ee2f6f816cf45df3de6b219aceb5821845522a22ea59e24f1096a2804bab7
SSDEEP

3072:ufsF5FwNIH9yxJsi/0IWB5OxxXATIzJcurDeM4/rs:is1chk20rewmJmM4Ds

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3796	2824	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3836 wrote to memory of 2824	3836	rundll32.exe	81
PID 3836 wrote to memory of 2824	3836	rundll32.exe	81
PID 3836 wrote to memory of 2824	3836	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fb7bca9431ab734da980b67e428e8e3a622ed51281daa7bdba76b552631b839.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fb7bca9431ab734da980b67e428e8e3a622ed51281daa7bdba76b552631b839.dll,#1
  2⤵
  PID:2824
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 584
    3⤵
    - Program crash
    PID:3796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2824 -ip 2824
1⤵
PID:5056