feef7c585a67e368ce1a514158d6abc280e502b0408ad8b589d83687360ff11f

Analysis

max time kernel
76s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2023 21:59

Target

50d0a3b32e813c671248f0f2fe10c3c237ee94bfa94fcaf86886fc3a64d79b88.dll
Size

60KB
MD5

af850c572f4805830df79180b04ae52e
SHA1

8261158838f46a63ea08dd9b0b45262247c371ac
SHA256

50d0a3b32e813c671248f0f2fe10c3c237ee94bfa94fcaf86886fc3a64d79b88
SHA512

2eec61676ecd902d79a7a266893861eff5903345aa7753e94ce7c3cffa0ba08c7c386a29a8148cc4caa1c7bc7410df08d29387745f9690b9f9a617d048c7604d
SSDEEP

768:AUmQgYEOvCZf8/gGB/RQCT4Is9OqC3sGs8qSardvWNhULPyKdUNexpRYhTr:+Qgle5bkIs91gsGsBZuN+LPyCaT

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1672 4276 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1672	4276	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4620 wrote to memory of 4276	4620	rundll32.exe	rundll32.exe
PID 4620 wrote to memory of 4276	4620	rundll32.exe	rundll32.exe
PID 4620 wrote to memory of 4276	4620	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\50d0a3b32e813c671248f0f2fe10c3c237ee94bfa94fcaf86886fc3a64d79b88.dll, DllRegisterServer
1⤵
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\50d0a3b32e813c671248f0f2fe10c3c237ee94bfa94fcaf86886fc3a64d79b88.dll, DllRegisterServer
  2⤵
  PID:4276
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4276 -s 560
    3⤵
    - Program crash
    PID:1672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4276 -ip 4276
1⤵
PID:2104