476e834197ac6cd3080059d86a8a2a49e31212ed75e0d68e4e21fcc3bc6b1d8b

Analysis

max time kernel
140s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2023, 12:31

Target
187737.dat.dll
Size 771KB
Sample230214-pp2qeacf8x
SHA256 476e834197ac6cd3080059d86a8a2a49e31212ed75e0d68e4e21fcc3bc6b1d8b
MD5 ac377cea30d0b6227c70ae0ef6871f71
SHA1 1223a42bea918585ed4ea77e6c8ad9b3f151e2a7
SHA512 a485d993902673aeeb0cecf57f1fb3d0b0f5c24d11dc769831be6f2ad48024c5d1fe088629befd75f281154df99721e414fe45a57a376a364af7637ea19d0cd7
SSDEEP 24576:/H81smt4vyVjXe1ikZdtjMsc7MscXMscktkTNd8uB:kefBtkf8
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4192	4172	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4488 wrote to memory of 4172	4488	rundll32.exe	81
PID 4488 wrote to memory of 4172	4488	rundll32.exe	81
PID 4488 wrote to memory of 4172	4488	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\187737.dat.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\187737.dat.dll,#1
  2⤵
  PID:4172
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 632
    3⤵
    - Program crash
    PID:4192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 4172 -ip 4172
1⤵
PID:4268