871ae5b567e478dd9a5f3601f24758d1315f38b659497a9bda3c701776fc8409

Analysis

max time kernel
134s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2022 14:04

Target

469e06adc60ffd19490a9fe561ceff99cc5c8ce5b0ddb652a24acd03265c0c65.dll
Size

8.3MB
MD5

d6340fd7927ba1ecc8b8dca640cc7998
SHA1

fd6570f966b3b39ee7664336ae8a4d12c9a8d414
SHA256

469e06adc60ffd19490a9fe561ceff99cc5c8ce5b0ddb652a24acd03265c0c65
SHA512

b9000ca6fa9f3ee9c0ddac05569d8f881c95217baf2fe730f94e140dfecf438fe6c35f148ae910a3175e524a673fefc17a25c6e71aeb94a627f78fd3399ba3fc
SSDEEP

49152:8SFvrQJFY83N4qsYiGsiEnaZQTCBjDpN+v0Bkl7CqfaJDJk/SET9y2zkp:5cJ12xG8a+TWPpNG669DQp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2464	4836	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 4836	4740	rundll32.exe	79
PID 4740 wrote to memory of 4836	4740	rundll32.exe	79
PID 4740 wrote to memory of 4836	4740	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\469e06adc60ffd19490a9fe561ceff99cc5c8ce5b0ddb652a24acd03265c0c65.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\469e06adc60ffd19490a9fe561ceff99cc5c8ce5b0ddb652a24acd03265c0c65.dll,#1
  2⤵
  PID:4836
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 560
    3⤵
    - Program crash
    PID:2464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4836 -ip 4836
1⤵
PID:4764