e87d8fcde3ac1f69a66e9025cce97bf51127e52c4c8f944adb84ce09361db1b7

Analysis

max time kernel
124s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 17:54

Target

e87d8fcde3ac1f69a66e9025cce97bf51127e52c4c8f944adb84ce09361db1b7.dll
Size

22KB
MD5

1c9a080a769fbca0ef845b3ae23b3f77
SHA1

0320a0e264d263a27e928b1e3ed08ad7735a827c
SHA256

e87d8fcde3ac1f69a66e9025cce97bf51127e52c4c8f944adb84ce09361db1b7
SHA512

9eb038781f8cf83ca466cb6fab042ca7b2bbd5240eb8520fb2eaacdcbc72916239cfe76c5a8c3ec7ec815258b084e485dd12c07c5a78ff42155b6c9b3d99b482
SSDEEP

384:atS+IKFslGKas4RVXjQvNAlcDC9bydBrv9UKR+FYcmcTl:wfILlGKmRVkKycKHRAYfc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4260	4940	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 4940	4712	rundll32.exe	80
PID 4712 wrote to memory of 4940	4712	rundll32.exe	80
PID 4712 wrote to memory of 4940	4712	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e87d8fcde3ac1f69a66e9025cce97bf51127e52c4c8f944adb84ce09361db1b7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e87d8fcde3ac1f69a66e9025cce97bf51127e52c4c8f944adb84ce09361db1b7.dll,#1
  2⤵
  PID:4940
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 560
    3⤵
    - Program crash
    PID:4260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 4940 -ip 4940
1⤵
PID:1324