cb4aa87d94c914fccea849ad1a2af061f2f77ddd0a20a2b5c97c3023cddb9d93

Analysis

max time kernel
143s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 17:35

Target

cb4aa87d94c914fccea849ad1a2af061f2f77ddd0a20a2b5c97c3023cddb9d93.dll
Size

223KB
MD5

82b27e09dc20213a1019b3e4fd2437ed
SHA1

6f2d68216f4f6d3025b001e04f76c6ec031846bb
SHA256

cb4aa87d94c914fccea849ad1a2af061f2f77ddd0a20a2b5c97c3023cddb9d93
SHA512

4148ec7724bc99c7d0165b4a9aeab19c645450a124a78a1bf17fc81db7c6647fce15025a31ca5ed573687947c35aab6094194ca6de8c028fd5978f02a23ea4a1
SSDEEP

3072:e0saBrMawfLEeu/U+JxkApGEmyhRMAfuXaxNPbnriW4uc7Xz0bdlMBhiAdyXhoik:e0sorjRU+g5AfuqPbnWD4plM/qhBl

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3776	3884	WerFault.exe	79
4804	3884	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 3884	1224	rundll32.exe	79
PID 1224 wrote to memory of 3884	1224	rundll32.exe	79
PID 1224 wrote to memory of 3884	1224	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb4aa87d94c914fccea849ad1a2af061f2f77ddd0a20a2b5c97c3023cddb9d93.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb4aa87d94c914fccea849ad1a2af061f2f77ddd0a20a2b5c97c3023cddb9d93.dll,#1
  2⤵
  PID:3884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3884 -s 544
    3⤵
    - Program crash
    PID:3776
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3884 -s 776
    3⤵
    - Program crash
    PID:4804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3884 -ip 3884
1⤵
PID:4868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3884 -ip 3884
1⤵
PID:4788