d297fe63797249c87f5fbeedfba1f42a6b828aa912f49cf50a730b4a77be0014

Analysis

max time kernel
91s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 17:36

Target

d297fe63797249c87f5fbeedfba1f42a6b828aa912f49cf50a730b4a77be0014.dll
Size

781KB
MD5

078383e8e90abfedd1efb167787b7313
SHA1

8d1e0e5373260d2147cdf5d18cdda8055c385313
SHA256

d297fe63797249c87f5fbeedfba1f42a6b828aa912f49cf50a730b4a77be0014
SHA512

8179826e3168bbe04f3b772b1c1ea649dc3b994e4966fe410a10c30e9b469bf41eb29213434e02e54fe2efdb095949459eb4956102add6b97010e82199d2c7d3
SSDEEP

24576:bUHCXJByrdNpZwUg1EdLZvFwp2s61FABdV6:Y8WPFcEdLZNps6V

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3196	540	WerFault.exe	76

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 540	5080	rundll32.exe	76
PID 5080 wrote to memory of 540	5080	rundll32.exe	76
PID 5080 wrote to memory of 540	5080	rundll32.exe	76

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d297fe63797249c87f5fbeedfba1f42a6b828aa912f49cf50a730b4a77be0014.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d297fe63797249c87f5fbeedfba1f42a6b828aa912f49cf50a730b4a77be0014.dll,#1
  2⤵
  PID:540
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 688
    3⤵
    - Program crash
    PID:3196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 540 -ip 540
1⤵
PID:1768