a9bce76c18394c5d5520e59e6a62ba08b8868f9b92a1f397185e2dcb8fbf3d02

Analysis

max time kernel
172s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 01:56

Target

a9bce76c18394c5d5520e59e6a62ba08b8868f9b92a1f397185e2dcb8fbf3d02.dll
Size

112KB
MD5

aa4e0d463d7bc3aa8d19e78688bfa1b9
SHA1

9e7467025b106383806583f3e198505b0c8518c4
SHA256

a9bce76c18394c5d5520e59e6a62ba08b8868f9b92a1f397185e2dcb8fbf3d02
SHA512

d88bdf33e591eaf731fedfc81e74ee1b66ec79cf726c9cb9a5336eee5617e7510a994de4da136f6dd4b20c5c698e371171c799af379450584bc4464f7c6e7cde
SSDEEP

1536:tpfSJIs7a/U7Z/4cKDqxYwhyrb8gMCcbE6f47UZGo:bfSWcZQ5wsMCkE847UR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4880	3792	WerFault.exe	70

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 3792	3052	rundll32.exe	70
PID 3052 wrote to memory of 3792	3052	rundll32.exe	70
PID 3052 wrote to memory of 3792	3052	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9bce76c18394c5d5520e59e6a62ba08b8868f9b92a1f397185e2dcb8fbf3d02.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9bce76c18394c5d5520e59e6a62ba08b8868f9b92a1f397185e2dcb8fbf3d02.dll,#1
  2⤵
  PID:3792
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3792 -s 544
    3⤵
    - Program crash
    PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3792 -ip 3792
1⤵
PID:4504