f5ae263677affd76211e6b7645f8f1c6e40812ad714a556b2ba8330cbed3972e

Analysis

max time kernel
157s
max time network
202s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 05:50

Target

f5ae263677affd76211e6b7645f8f1c6e40812ad714a556b2ba8330cbed3972e.dll
Size

76KB
MD5

432dc913eb0af9a1eebd9c00a14ad9e0
SHA1

7696aa9e2187fc1c8526473f25e1a943e22f18a0
SHA256

f5ae263677affd76211e6b7645f8f1c6e40812ad714a556b2ba8330cbed3972e
SHA512

c1d78d7f56f15bd462bb46a520ea8a231fd09b7f3389f16674bff078eaa5a8389cbaae562f0dbfc2cc4eb8b71251f655be87c8c0607ac4b0a452c7d8752fc061
SSDEEP

768:XyEPKVrhnFjiWmmYat2nm8EppbZAK9JXo2Hc+jJIWwt8qydMJzGQNUx:iIKBfvtimLg28SJNwtfydaGQNU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3732	3600	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 3600	5040	rundll32.exe	81
PID 5040 wrote to memory of 3600	5040	rundll32.exe	81
PID 5040 wrote to memory of 3600	5040	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f5ae263677affd76211e6b7645f8f1c6e40812ad714a556b2ba8330cbed3972e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f5ae263677affd76211e6b7645f8f1c6e40812ad714a556b2ba8330cbed3972e.dll,#1
  2⤵
  PID:3600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3600 -s 612
    3⤵
    - Program crash
    PID:3732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 3600 -ip 3600
1⤵
PID:2464