feef7c585a67e368ce1a514158d6abc280e502b0408ad8b589d83687360ff11f

Analysis

max time kernel
141s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2023 21:59

Target

4d81b964b809d1d3c642d331f17f80ee013fdd2b8bd2cffd191449313ea92353.dll
Size

464KB
MD5

b3e9aab33e74a23796b3e442920c9b7e
SHA1

c8b8986658588fb0adb97ca8c7b8fe8f0c5a974b
SHA256

4d81b964b809d1d3c642d331f17f80ee013fdd2b8bd2cffd191449313ea92353
SHA512

c43cdf877f01603845953a384934a22d2006ac841d14d2f301c3162ff8d05723c9a722506629134b08ba5ff5f5cd940e69cf0df558db9670695f03f8c4439575
SSDEEP

6144:eH1DBotbwjld1m1kGQnNrHRoaiCrIB28UJ1F5FRpS0X:eHhBaydQxqNrxoaHrIByJ13pR

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3988 4608 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3988	4608	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4432 wrote to memory of 4608	4432	rundll32.exe	rundll32.exe
PID 4432 wrote to memory of 4608	4432	rundll32.exe	rundll32.exe
PID 4432 wrote to memory of 4608	4432	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d81b964b809d1d3c642d331f17f80ee013fdd2b8bd2cffd191449313ea92353.dll, DllRegisterServer
1⤵
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d81b964b809d1d3c642d331f17f80ee013fdd2b8bd2cffd191449313ea92353.dll, DllRegisterServer
  2⤵
  PID:4608
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4608 -s 548
    3⤵
    - Program crash
    PID:3988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4608 -ip 4608
1⤵
PID:732