f3d204eba56ae4295908775d3de66f65a04cade60a9285c8966dd8c3a2680237

Analysis

max time kernel
82s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
10-01-2023 21:28

Target

f3d204eba56ae4295908775d3de66f65a04cade60a9285c8966dd8c3a2680237.dll
Size

488KB
MD5

555768b59718a036ff5f1ce8b95bde1b
SHA1

4b56011bffe1090e17f1bacb703c2f5424d597ec
SHA256

f3d204eba56ae4295908775d3de66f65a04cade60a9285c8966dd8c3a2680237
SHA512

73f2d8482cb36265ca031dff1945553bcfbe1c0e3e01ab96f405f099565065062c592502a2595f3822fdfb2a02c9c95162a5a27cb467bd89df5d7cd3e3906298
SSDEEP

12288:4oDwGY8r3ByhULvTiIeYcdG3NUGQFjPb9i1:KuduULv13NUGQFH9i1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4200	4940	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 4940	2340	rundll32.exe	83
PID 2340 wrote to memory of 4940	2340	rundll32.exe	83
PID 2340 wrote to memory of 4940	2340	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f3d204eba56ae4295908775d3de66f65a04cade60a9285c8966dd8c3a2680237.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f3d204eba56ae4295908775d3de66f65a04cade60a9285c8966dd8c3a2680237.dll,#1
  2⤵
  PID:4940
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 600
    3⤵
    - Program crash
    PID:4200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4940 -ip 4940
1⤵
PID:4072