d7608b8f684e7465599a4673fefa329de646e38d934dd79e592288c68720bcfa

Analysis

max time kernel
84s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
14/04/2023, 07:04

Target

d7608b8f684e7465599a4673fefa329de646e38d934dd79e592288c68720bcfa.dll
Size

556KB
MD5

c9ab1cd04e796fd7f084a1dd2d40cc2d
SHA1

f05b2066a375a5c8d3dfc44d6097f577cd4f0255
SHA256

d7608b8f684e7465599a4673fefa329de646e38d934dd79e592288c68720bcfa
SHA512

ad974a30ac9e5915cb221db1c07fbaaa2d7b7f9a820841c62e887347abec76e8b626d97cfca6fb386a74f2f4bc89a4c484e46cc585770cd215e357eca0b13d9c
SSDEEP

12288:0sqXe4DNX3lWA38yEDJQTiaQS8LztCYKH5t3XjMjDW:vqXeSNX3lWA3DEeCLcYKbIj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1760	4464	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 4464	4736	rundll32.exe	83
PID 4736 wrote to memory of 4464	4736	rundll32.exe	83
PID 4736 wrote to memory of 4464	4736	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d7608b8f684e7465599a4673fefa329de646e38d934dd79e592288c68720bcfa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d7608b8f684e7465599a4673fefa329de646e38d934dd79e592288c68720bcfa.dll,#1
  2⤵
  PID:4464
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4464 -s 600
    3⤵
    - Program crash
    PID:1760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4464 -ip 4464
1⤵
PID:2476