e27d35a1b07cb44dcb1458f5df92e314487cf583aac04d5182e80f300beb3444

Analysis

max time kernel
90s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 21:49

Target

e27d35a1b07cb44dcb1458f5df92e314487cf583aac04d5182e80f300beb3444.dll
Size

95KB
MD5

8d30f34f4fbb80aa3ae598f0985bac88
SHA1

86ef848c77ba188e795adca68c38875c3da5dd23
SHA256

e27d35a1b07cb44dcb1458f5df92e314487cf583aac04d5182e80f300beb3444
SHA512

1eba2f973f33ba72d52a89d95c92bb1bbb5e24c8e568e72639da7642a40d671866f26d6eb674cdedf0e5b5f89a81920c9120c3ab136f878676311168df0ea611
SSDEEP

1536:I5x9SogXZyIpw4UbLp3Je8cj/zf82smrvaoQiMvayTwlwikb:ox+ZIre8o/T82sboLNyTwlwiE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5076	4908	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 4908	2636	rundll32.exe	79
PID 2636 wrote to memory of 4908	2636	rundll32.exe	79
PID 2636 wrote to memory of 4908	2636	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e27d35a1b07cb44dcb1458f5df92e314487cf583aac04d5182e80f300beb3444.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e27d35a1b07cb44dcb1458f5df92e314487cf583aac04d5182e80f300beb3444.dll,#1
  2⤵
  PID:4908
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 660
    3⤵
    - Program crash
    PID:5076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4908 -ip 4908
1⤵
PID:4568