958917246febec537b25e83a36a5c7ab7c78b3213e2ef7303f9ec833d085cfaa

Analysis

max time kernel
135s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
24-04-2023 14:57

Target

3b195a8aa292fdc61d76fa0aa7634d2eb922b787c48e9c4909765d6c4a25aea0.dll
Size

100KB
MD5

773160f2618711ba74012622147c84e0
SHA1

a7a5f3beb7c0424b7a509fe3b5933d557bee5575
SHA256

3b195a8aa292fdc61d76fa0aa7634d2eb922b787c48e9c4909765d6c4a25aea0
SHA512

79109c6794015545d7d4a9dc33dbe1b798d7ae867d545f3152593014f43133a7e7c0d6860fb9ea70bd5f2997951aaede97cfb8928586d7c8395137a92edbeb6b
SSDEEP

3072:tdmAFN6g4tFmFG5dT3IisD2/pp7QHeaiBCpfhRFEDgiw:PteFGG/ciE2/ppMHOBCigh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1644	1120	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 1120	1224	rundll32.exe	84
PID 1224 wrote to memory of 1120	1224	rundll32.exe	84
PID 1224 wrote to memory of 1120	1224	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b195a8aa292fdc61d76fa0aa7634d2eb922b787c48e9c4909765d6c4a25aea0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b195a8aa292fdc61d76fa0aa7634d2eb922b787c48e9c4909765d6c4a25aea0.dll,#1
  2⤵
  PID:1120
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 596
    3⤵
    - Program crash
    PID:1644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1120 -ip 1120
1⤵
PID:4332