e28111468cfb0cac7c6a95aa86bcb0523c2dd81d0e0b0a04c615397e94a5f5c7

Analysis

max time kernel
320s
max time network
404s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 00:58

Target

e28111468cfb0cac7c6a95aa86bcb0523c2dd81d0e0b0a04c615397e94a5f5c7.dll
Size

5KB
MD5

e790bfb454c23f5a811e83b30059a870
SHA1

df27eb6a95ea551074051b6375fc786fef8f6e0b
SHA256

e28111468cfb0cac7c6a95aa86bcb0523c2dd81d0e0b0a04c615397e94a5f5c7
SHA512

7a7106eefdf30d78ba78ed32d2943fbe9b615b003474c28e78485ebeedb08f45839a5021d151c25d48eb5fb5bdf950c762d7c07316ffffcca000e0c98ed9bc1b
SSDEEP

48:SASAl6a98rtNVhWOZU8tOZGKHLMTbbQ8HfrLFnYBueGJMr:f8rv2OZVtOZdYTA8DLZYIe1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4680	4852	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 4852	2944	rundll32.exe	80
PID 2944 wrote to memory of 4852	2944	rundll32.exe	80
PID 2944 wrote to memory of 4852	2944	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e28111468cfb0cac7c6a95aa86bcb0523c2dd81d0e0b0a04c615397e94a5f5c7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e28111468cfb0cac7c6a95aa86bcb0523c2dd81d0e0b0a04c615397e94a5f5c7.dll,#1
  2⤵
  PID:4852
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 572
    3⤵
    - Program crash
    PID:4680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4852 -ip 4852
1⤵
PID:3700