e9c8a6958aa7d3d417fb48d8bdc9efe464cbb4bcd4a5faeaa742e574d254b8be

Analysis

max time kernel
133s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2023, 08:08

Target

d7f27bcd068821e3b541ffcc181509ab84636aec7f800c709c91b59c0795e95c.dll
Size

720KB
MD5

0cc5d5ce37dc79ee687c1e6b04c9ac6f
SHA1

8ad71d0e26666455e688c0f4d8d634a16bedc0f1
SHA256

d7f27bcd068821e3b541ffcc181509ab84636aec7f800c709c91b59c0795e95c
SHA512

34a0d2d399a5f819175a16324a2583fbcf6ea7a8ccd4ac5dc1b7a5c21b307b303e2878b6134a660188077764035990abef36b7f107145240c1194d8591f6cab0
SSDEEP

12288:9qwFxm3G6H4RyuHbR1MxnuTV/iV1SdURA8s2Q5Qp:QwFxm3G6H4IuHbR1MxnuTV/iV1QTQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4804	4336	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3928 wrote to memory of 4336	3928	rundll32.exe	79
PID 3928 wrote to memory of 4336	3928	rundll32.exe	79
PID 3928 wrote to memory of 4336	3928	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d7f27bcd068821e3b541ffcc181509ab84636aec7f800c709c91b59c0795e95c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d7f27bcd068821e3b541ffcc181509ab84636aec7f800c709c91b59c0795e95c.dll,#1
  2⤵
  PID:4336
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 600
    3⤵
    - Program crash
    PID:4804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 4336 -ip 4336
1⤵
PID:4864