ac99b1d6fa6746b9a2e89f404e88a7fc249daf9cda5bb1f1639371cd36379237

Analysis

max time kernel
144s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2022, 19:08

Target
user.dat.dll
Size 516KB
Sample221222-xs7ptsac21
SHA256 ac99b1d6fa6746b9a2e89f404e88a7fc249daf9cda5bb1f1639371cd36379237
MD5 e351d66cd0103864d9fdb439a451b253
SHA1 d1d9c420c4b06e33f4bd8b84f740be04db035fc4
SHA512 002c853352a06868d0a9b0201ee7dfc5e83b201c48d85bb7914f3e314012256129a752d8b05829074ee3364656a2c239f5eae0105c3597a432f89961b6d7bb62
SSDEEP 12288:+ihnctArBgRprvbiIIAuz19n26pmpmlCO:HnqAyprvbiIIAuRUmxf
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3108	764	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 764	1144	rundll32.exe	80
PID 1144 wrote to memory of 764	1144	rundll32.exe	80
PID 1144 wrote to memory of 764	1144	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\user.dat.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\user.dat.dll,#1
  2⤵
  PID:764
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 604
    3⤵
    - Program crash
    PID:3108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 764 -ip 764
1⤵
PID:1944