673b6dc41bf48145e595b8716256af2fd6b9bcc8bb74be149eeb70c7bdd8bc5a

Analysis

max time kernel
204s
max time network
216s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 09:30

Target

673b6dc41bf48145e595b8716256af2fd6b9bcc8bb74be149eeb70c7bdd8bc5a.dll
Size

692KB
MD5

971b4ec0b1b8912010b7054f9c126730
SHA1

c1a6d2e9ef4d2be9fe79c5c43c945918dbc8078e
SHA256

673b6dc41bf48145e595b8716256af2fd6b9bcc8bb74be149eeb70c7bdd8bc5a
SHA512

0b0e78440fd7a7141e1df9b32c437fea9cbc4321196be49c9bf62055570eebd084328670be4702bab59b4d45b724957301191b93014c28257f0df0756d755131
SSDEEP

12288:/KVFmYv7Z+bLBB70mcwEGojg6g1OkD8puSjfoduLSvrljU:/KVMY70P7ojgt0puSjwdTlQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4588	2548	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 2548	644	rundll32.exe	83
PID 644 wrote to memory of 2548	644	rundll32.exe	83
PID 644 wrote to memory of 2548	644	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\673b6dc41bf48145e595b8716256af2fd6b9bcc8bb74be149eeb70c7bdd8bc5a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\673b6dc41bf48145e595b8716256af2fd6b9bcc8bb74be149eeb70c7bdd8bc5a.dll,#1
  2⤵
  PID:2548
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 604
    3⤵
    - Program crash
    PID:4588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2548 -ip 2548
1⤵
PID:4740