8ebad39a9a14da38715bf4913dd7e0580e4ecba7ca2b70a7e6b0c7a40626d21b

Analysis

max time kernel
184s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 14:00

Target

8ebad39a9a14da38715bf4913dd7e0580e4ecba7ca2b70a7e6b0c7a40626d21b.dll
Size

100KB
MD5

4041d4bc415fcf600c7a2e53a82d7b73
SHA1

46492a0e0352b728bc849a73f12e6f7b890e55c0
SHA256

8ebad39a9a14da38715bf4913dd7e0580e4ecba7ca2b70a7e6b0c7a40626d21b
SHA512

8d6a37a86b16d22c9016aa8ea6e9eb41f006d7494180be23f0ad816dc3d9ba4124822bfe41e43e3691faa9700e200abd2efec8f9a2403054d22f76143030feab
SSDEEP

1536:iLFcH2dDiBZFxi3nzm72P/hAPwzYosTb2AAoMfT0mhsPoHh2AFhPlO3w9BSaY3GV:tH2eOz5PZAmYoO2AElhsPoB2AL9YWV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3800	2348	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 2348	1432	rundll32.exe	82
PID 1432 wrote to memory of 2348	1432	rundll32.exe	82
PID 1432 wrote to memory of 2348	1432	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8ebad39a9a14da38715bf4913dd7e0580e4ecba7ca2b70a7e6b0c7a40626d21b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8ebad39a9a14da38715bf4913dd7e0580e4ecba7ca2b70a7e6b0c7a40626d21b.dll,#1
  2⤵
  PID:2348
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 544
    3⤵
    - Program crash
    PID:3800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2348 -ip 2348
1⤵
PID:4412