783d2abe8b18a7d42593072cca918b9c6295c341eec4e8927973f1387441795e

Analysis

max time kernel
113s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11-02-2023 18:14

Target

783d2abe8b18a7d42593072cca918b9c6295c341eec4e8927973f1387441795e.dll
Size

498KB
MD5

426366e0aec94f171e0c3ae94b7148f4
SHA1

401e4b2ffb4c25d2200453e3fa8abcbe0b6f7ef2
SHA256

783d2abe8b18a7d42593072cca918b9c6295c341eec4e8927973f1387441795e
SHA512

66c36f5175e132ee5bb36b364c2d3d69dbc022fe31c13e5dbc3cca699989bc12ad12e33cbb1e46c0ea28b8fb597e9f8d1c5d377cce3235754e2ae4f5f86cb942
SSDEEP

6144:7VQwSj8EXRVY4ekEJhnSRMWVFw/t4ZcWDny60ioHI57oIvEXRVY4eu506Iye57Tm:7xW/eh62gFye1yj9HI5syW/euNFgaZp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4964	1000	WerFault.exe	78

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 1000	2420	rundll32.exe	78
PID 2420 wrote to memory of 1000	2420	rundll32.exe	78
PID 2420 wrote to memory of 1000	2420	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\783d2abe8b18a7d42593072cca918b9c6295c341eec4e8927973f1387441795e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\783d2abe8b18a7d42593072cca918b9c6295c341eec4e8927973f1387441795e.dll,#1
  2⤵
  PID:1000
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 588
    3⤵
    - Program crash
    PID:4964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1000 -ip 1000
1⤵
PID:4980