92b38091f9f7e830d083f33f0303640cf381c302d03ec3cc742fee1312216e31

Analysis

max time kernel
102s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
16/02/2023, 04:50

Target

92b38091f9f7e830d083f33f0303640cf381c302d03ec3cc742fee1312216e31.dll
Size

4.9MB
MD5

2ecf1b072a18a1422cf930b11e2c3247
SHA1

d9ca379437a0fa5906c5742c18a896c5c4ea5709
SHA256

92b38091f9f7e830d083f33f0303640cf381c302d03ec3cc742fee1312216e31
SHA512

f451b0f1cda54262ab75839a0acca849715dbf686a19087192ebd1e78ca1b88377e96553efeeb650c2ecb35f923331af348f713cb461113b7fd03f64ef05cb2a
SSDEEP

98304:fBHB2pne7a1mN1E8lkcf5YjovKqGYiOE8oLj5jIrHL3GqHqh:fv1GGE5gyjovK65E8oqjLPu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4804	4356	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 4356	1104	rundll32.exe	80
PID 1104 wrote to memory of 4356	1104	rundll32.exe	80
PID 1104 wrote to memory of 4356	1104	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\92b38091f9f7e830d083f33f0303640cf381c302d03ec3cc742fee1312216e31.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\92b38091f9f7e830d083f33f0303640cf381c302d03ec3cc742fee1312216e31.dll,#1
  2⤵
  PID:4356
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 688
    3⤵
    - Program crash
    PID:4804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4356 -ip 4356
1⤵
PID:2580