74001e9572641e53deebf6359e7ef90f3fd85f768c02a01200eeeaf08ead2a44

Analysis

max time kernel
191s
max time network
202s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2023, 18:48

Target

a42LfkJ6QAc8s9R.dll
Size

332KB
MD5

c8c2b0c625aadd480f246fd9cbde0dea
SHA1

b45046e5728f82ba549b6a637c30b969066a8c68
SHA256

74001e9572641e53deebf6359e7ef90f3fd85f768c02a01200eeeaf08ead2a44
SHA512

d092988399b32117a2c521dd0de0c26724568f2032a19f6c7820ecde624f2559b70866ea6905eb54c9597f85f94f463d39c3ddddbf4e6cd72699d3afd28bb80b
SSDEEP

6144:HGttsygB2RWc0sVk5k6A4s9FGMReiD4DmEk5cci4j5zLgSdsg:mttsygB2RWc0sV6k6AbDGSPzqciwpPd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
636	4276	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 4276	2100	rundll32.exe	80
PID 2100 wrote to memory of 4276	2100	rundll32.exe	80
PID 2100 wrote to memory of 4276	2100	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a42LfkJ6QAc8s9R.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a42LfkJ6QAc8s9R.dll,#1
  2⤵
  PID:4276
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4276 -s 600
    3⤵
    - Program crash
    PID:636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4276 -ip 4276
1⤵
PID:2004