9ef5a6843ed183b9c907ceaf8598029f1c94c8be401088677991c2745391b8c3

Analysis

max time kernel
137s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18-12-2022 18:54

Target

9ef5a6843ed183b9c907ceaf8598029f1c94c8be401088677991c2745391b8c3.dll
Size

488KB
MD5

2bf14aa9ac641ea5d51c3cea1e59785e
SHA1

812a6486e2c24d6f3ad9e507738c26047778ffbf
SHA256

9ef5a6843ed183b9c907ceaf8598029f1c94c8be401088677991c2745391b8c3
SHA512

b90e51ef9f1fb6a6e7c2b0d9fbd733c2ad02b8cf0b4b8ae0476b23411db4be42a807876862cd652926b07cf14bfe17df1addb048ed560adef72fd960726e7f8f
SSDEEP

12288:4oDwZY8r3ByhULvTiIeYcdG3NUGQFjPb9K1:KdduULv13NUGQFH9K1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4136	4968	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 4968	2548	rundll32.exe	82
PID 2548 wrote to memory of 4968	2548	rundll32.exe	82
PID 2548 wrote to memory of 4968	2548	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ef5a6843ed183b9c907ceaf8598029f1c94c8be401088677991c2745391b8c3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ef5a6843ed183b9c907ceaf8598029f1c94c8be401088677991c2745391b8c3.dll,#1
  2⤵
  PID:4968
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 600
    3⤵
    - Program crash
    PID:4136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4968 -ip 4968
1⤵
PID:4944