cb1dc100ea6157653a7679c52b54f376b5dad58c0dc554e1e6075b6cb843b778

Analysis

max time kernel
101s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 19:25

Target

cb1dc100ea6157653a7679c52b54f376b5dad58c0dc554e1e6075b6cb843b778.dll
Size

68KB
MD5

2a4e71611592169da219eb7443ed24fa
SHA1

d5d7ac604bb410ce494499c7774f9eeeb9826be3
SHA256

cb1dc100ea6157653a7679c52b54f376b5dad58c0dc554e1e6075b6cb843b778
SHA512

c83b66aa5ce0d1dd0f5e1ad6c1d5ada04159fd15b81499cd4b25421c8bba5d6ed305fccd1940073bb0c55c71dc8d905eefb26e966b163e13bcc610e8a1637ac9
SSDEEP

1536:71Dz04FE/PKhhU16bhFqPlJoeGOX0YoSQYBabEXFCtEY+yl:7xz0I0nX0QbabKForl

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3548	4792	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 4792	4800	rundll32.exe	81
PID 4800 wrote to memory of 4792	4800	rundll32.exe	81
PID 4800 wrote to memory of 4792	4800	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb1dc100ea6157653a7679c52b54f376b5dad58c0dc554e1e6075b6cb843b778.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb1dc100ea6157653a7679c52b54f376b5dad58c0dc554e1e6075b6cb843b778.dll,#1
  2⤵
  PID:4792
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 636
    3⤵
    - Program crash
    PID:3548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4792 -ip 4792
1⤵
PID:4960