b3f876c9ff3d462247bb2befdacb697923a5fc1aa496d323474fce2297f5b8f7

Analysis

max time kernel
81s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 15:32

Target

b3f876c9ff3d462247bb2befdacb697923a5fc1aa496d323474fce2297f5b8f7.dll
Size

364KB
MD5

c5e11c1b46fc4cac3643d9868b29f1db
SHA1

d4128f242378b63f9584645b14da68dd447ddf41
SHA256

b3f876c9ff3d462247bb2befdacb697923a5fc1aa496d323474fce2297f5b8f7
SHA512

5fd5b08541e088382a32c7925b236d32c871e83b10ebad0772425847ac4395459da89813e64b9be7a6f02d0950301e4b3e1f510cc1713f29b23dcb88e73bde40
SSDEEP

6144:xWlCQzP9Boj79gKwZhQZBSvxMrQ1RRPFiCSjM0QMD/sMFMDIPO/rA:xWJIgLZhQOvWE1RRtiCSjBDnFM8Oz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4280	1368	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4424 wrote to memory of 1368	4424	rundll32.exe	83
PID 4424 wrote to memory of 1368	4424	rundll32.exe	83
PID 4424 wrote to memory of 1368	4424	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b3f876c9ff3d462247bb2befdacb697923a5fc1aa496d323474fce2297f5b8f7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b3f876c9ff3d462247bb2befdacb697923a5fc1aa496d323474fce2297f5b8f7.dll,#1
  2⤵
  PID:1368
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 572
    3⤵
    - Program crash
    PID:4280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1368 -ip 1368
1⤵
PID:1716