dda1ba12f768f4bc82f0295e13c42669a70ee19d41befe73a2301dc390ac0055

Analysis

max time kernel
133s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
24-03-2023 04:35

Target

dda1ba12f768f4bc82f0295e13c42669a70ee19d41befe73a2301dc390ac0055.dll
Size

4.2MB
MD5

95aaf6ea2605e4595410c6ba74a34447
SHA1

94b44c819eec5c2852dbd0f3b8e3cdd0112077af
SHA256

dda1ba12f768f4bc82f0295e13c42669a70ee19d41befe73a2301dc390ac0055
SHA512

9db74d36a2e0fb82d00888dab4f3a4e87ca59fdd849a7ba8db1db8627aee7b9905b4893279d3c7be29906aae821a62f19e0d956d15724435da225ca74077f721
SSDEEP

98304:fBHB2pne7a1mN1E8lkcf5YjovKqGYiOE8oLj5jIrHLz:fv1GGE5gyjovK65E8oqjLz

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1728 1096 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1728	1096	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1388 wrote to memory of 1096	1388	rundll32.exe	rundll32.exe
PID 1388 wrote to memory of 1096	1388	rundll32.exe	rundll32.exe
PID 1388 wrote to memory of 1096	1388	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dda1ba12f768f4bc82f0295e13c42669a70ee19d41befe73a2301dc390ac0055.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1388

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dda1ba12f768f4bc82f0295e13c42669a70ee19d41befe73a2301dc390ac0055.dll,#1
2⤵
PID:1096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 688
3⤵
- Program crash
PID:1728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1096 -ip 1096
1⤵
PID:4728