ecff5968d0d61c661b02207f8c28e7bcb227de6c82c4de21941f3c00b5a7e582

Analysis

max time kernel
154s
max time network
199s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 13:35

Target

ecff5968d0d61c661b02207f8c28e7bcb227de6c82c4de21941f3c00b5a7e582.dll
Size

4KB
MD5

79b5af457bf0a461fc93b6414d34f717
SHA1

d187472efa3c943cedda4aefa7b0c01d1091a948
SHA256

ecff5968d0d61c661b02207f8c28e7bcb227de6c82c4de21941f3c00b5a7e582
SHA512

a2a34eb8c7fc12aad6ee408a87ebe88c11f32d987dabc270768c689534e12f8fe6783f1078b6a13ea071ff53cbf2d30b305a7252a64a4c16b4528becd6ee56ad

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4284	5100	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 5100	856	rundll32.exe	82
PID 856 wrote to memory of 5100	856	rundll32.exe	82
PID 856 wrote to memory of 5100	856	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ecff5968d0d61c661b02207f8c28e7bcb227de6c82c4de21941f3c00b5a7e582.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ecff5968d0d61c661b02207f8c28e7bcb227de6c82c4de21941f3c00b5a7e582.dll,#1
  2⤵
  PID:5100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5100 -s 544
    3⤵
    - Program crash
    PID:4284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5100 -ip 5100
1⤵
PID:392