288f69a28574e77f3520a58b6cd8a355d0f961674b25b8757843600d0ddb06d6

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
15/02/2023, 07:50

Target

a462f77ec30da4687664618247d2d2735cdf3dd9aa0f8cd9f9c4abb9015c6b5f.dll
Size

448KB
MD5

7c69f6a5d73dd28444578b8b09d39e22
SHA1

f7df0646bb908a73cb8c0016b1841d3d601a81c0
SHA256

a462f77ec30da4687664618247d2d2735cdf3dd9aa0f8cd9f9c4abb9015c6b5f
SHA512

733c7198d5e60ddc9d82dfb0bba4dc71e9bc2c00a752577d02cc4537fc038d0a6e051d615cd7aafee63329409cafb74a1b894a52823e1ced53d3686c3f395e94
SSDEEP

6144:cJZRRRe1q7wXT1BakCSLdzOr2ewln8V7zDaVtfCvVBKR7fh1TiIBNYrIIg0a2M4n:cJZ701nXT1BaB4Irm8VGfn1N2g52MTA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4928	5060	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 5060	3444	rundll32.exe	81
PID 3444 wrote to memory of 5060	3444	rundll32.exe	81
PID 3444 wrote to memory of 5060	3444	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a462f77ec30da4687664618247d2d2735cdf3dd9aa0f8cd9f9c4abb9015c6b5f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a462f77ec30da4687664618247d2d2735cdf3dd9aa0f8cd9f9c4abb9015c6b5f.dll,#1
  2⤵
  PID:5060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 600
    3⤵
    - Program crash
    PID:4928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5060 -ip 5060
1⤵
PID:4032