a3b4c10988706d2dcefd1aa8de481128a73f38c4bdb4e1b53087093cee3bde89

Analysis

max time kernel
87s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2022, 06:15

Target

a3b4c10988706d2dcefd1aa8de481128a73f38c4bdb4e1b53087093cee3bde89.dll
Size

16KB
MD5

2c37f9d2e340bab43e98d82bd318e689
SHA1

d1ca74ad0c3bd777fb85fa8d133081da0afde79f
SHA256

a3b4c10988706d2dcefd1aa8de481128a73f38c4bdb4e1b53087093cee3bde89
SHA512

b0cfb151149fd9966d406614b35ec992dd2d115d3876dafa4a621c7e9c6ce86e380ab46e918cf6ab0f20442472c6ab3e5169f4793a1aec3ef64af72f599e99f0
SSDEEP

24:e1GSgDSEh5CglIB6SXvVmMP5TjvhBrDsqZ:SgDjllVImg9NBsG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
320	1388	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 1388	4612	rundll32.exe	81
PID 4612 wrote to memory of 1388	4612	rundll32.exe	81
PID 4612 wrote to memory of 1388	4612	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3b4c10988706d2dcefd1aa8de481128a73f38c4bdb4e1b53087093cee3bde89.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3b4c10988706d2dcefd1aa8de481128a73f38c4bdb4e1b53087093cee3bde89.dll,#1
  2⤵
  PID:1388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1388 -s 600
    3⤵
    - Program crash
    PID:320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1388 -ip 1388
1⤵
PID:2252