41d61ad0eee7039abbbdcaaeebb41afe28c2989cc1c1dd704c758a8f4991cb1c

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07/12/2022, 01:18

Target

41d61ad0eee7039abbbdcaaeebb41afe28c2989cc1c1dd704c758a8f4991cb1c.dll
Size

180KB
MD5

1e227951609e8e3947f5cbb5deb525aa
SHA1

8588244ae560d8954f10372e0069aa186cd19628
SHA256

41d61ad0eee7039abbbdcaaeebb41afe28c2989cc1c1dd704c758a8f4991cb1c
SHA512

2285e8dbe6a800ba1f26a1618588bbed1caf6986da150f73b21556dc416b8ae68a931c946b7809c350e6b15415496ff455673a1fbc5376a683d96d4ac841fd0f
SSDEEP

3072:4iKtV/UqhUh/+le4Q2rBdBMAiOiZ2tSgT:4fV/UqhU8lBBdBMdJT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2168	4964	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 4964	3564	rundll32.exe	80
PID 3564 wrote to memory of 4964	3564	rundll32.exe	80
PID 3564 wrote to memory of 4964	3564	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\41d61ad0eee7039abbbdcaaeebb41afe28c2989cc1c1dd704c758a8f4991cb1c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\41d61ad0eee7039abbbdcaaeebb41afe28c2989cc1c1dd704c758a8f4991cb1c.dll,#1
  2⤵
  PID:4964
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4964 -s 600
    3⤵
    - Program crash
    PID:2168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4964 -ip 4964
1⤵
PID:2576