f6a9c25a647abda32fdba32b423b1fe4817589667d2325a2ba6c6440a842f197

Analysis

max time kernel
157s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 11:26

Target

f6a9c25a647abda32fdba32b423b1fe4817589667d2325a2ba6c6440a842f197.dll
Size

36KB
MD5

6f9d95518a033a308620f6953c466980
SHA1

c169e590fea1a40f39a2b2d0911fc5ad4408b212
SHA256

f6a9c25a647abda32fdba32b423b1fe4817589667d2325a2ba6c6440a842f197
SHA512

31a818a8809c0d1fae7ed0b338fb48401c181e6fdd6d1aaf53b4c3bac918a5e448595c7d3c6103b211184b1d191340a10a387fb179b72612e065f0cf24e8de05
SSDEEP

96:qZ/Gom9y95CpIdFTbX2sqhA5WO9I//LfhhhemeHMol1xT:qBm9c5CpaXehA8O9I3zh+meHMolf

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
64412	4284	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 4284	4604	rundll32.exe	80
PID 4604 wrote to memory of 4284	4604	rundll32.exe	80
PID 4604 wrote to memory of 4284	4604	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f6a9c25a647abda32fdba32b423b1fe4817589667d2325a2ba6c6440a842f197.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f6a9c25a647abda32fdba32b423b1fe4817589667d2325a2ba6c6440a842f197.dll,#1
  2⤵
  PID:4284
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4284 -s 61800
    3⤵
    - Program crash
    PID:64412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4284 -ip 4284
1⤵
PID:63984