72b347b9990d06d8a72c66deed69a6ec14159cd6cb46ec23b202757e885b4e4a

Analysis

max time kernel
146s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 23:49

Target

72b347b9990d06d8a72c66deed69a6ec14159cd6cb46ec23b202757e885b4e4a.dll
Size

212KB
MD5

6b30060f5c4f829c2134e411828f3981
SHA1

0e25174116fe7ddcc5c9a2785fb6429620cab389
SHA256

72b347b9990d06d8a72c66deed69a6ec14159cd6cb46ec23b202757e885b4e4a
SHA512

6fda8848eb6a5c252ebd19a2a296ecc90ec22bd34523389a55afeab344a09f49d286b34bc67dc5e5ebb2386173f6f762cbc2d9928307865a0e233a080747dff9
SSDEEP

3072:Kfof6T/oelUit28FfmQwgSpxX2vcVKbhj8OiZVEZfroH0B9p8uptCir:Kfof6zo0FfZwrLXj8bhmZmZG0B91

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2268	3804	WerFault.exe	79
1620	3804	WerFault.exe	79

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 3804	4928	rundll32.exe	79
PID 4928 wrote to memory of 3804	4928	rundll32.exe	79
PID 4928 wrote to memory of 3804	4928	rundll32.exe	79
PID 3804 wrote to memory of 2268	3804	rundll32.exe	82
PID 3804 wrote to memory of 2268	3804	rundll32.exe	82
PID 3804 wrote to memory of 2268	3804	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\72b347b9990d06d8a72c66deed69a6ec14159cd6cb46ec23b202757e885b4e4a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\72b347b9990d06d8a72c66deed69a6ec14159cd6cb46ec23b202757e885b4e4a.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3804
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 612
    3⤵
    - Program crash
    PID:2268
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 612
    3⤵
    - Program crash
    PID:1620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3804 -ip 3804
1⤵
PID:2976