feef7c585a67e368ce1a514158d6abc280e502b0408ad8b589d83687360ff11f

Analysis

max time kernel
76s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2023 22:03

Target

05d1b791865c9551ed8da6a170eb6f945a4d1e79cb70341f589cc47bacf78cc3.dll
Size

28KB
MD5

4b532d1f869f1f91e3d5aca3133463b2
SHA1

e554c15efdd96bd12c4143efd406d222df8266bc
SHA256

05d1b791865c9551ed8da6a170eb6f945a4d1e79cb70341f589cc47bacf78cc3
SHA512

955fec31c475660eeb2ea325fc16c35d6f5e5029cbef83fffe4994236340271bf30a4f7f9ff7e8ccfa62ce26cc6aff94b5f1554cec61ca281e2b216b850feaba
SSDEEP

192:Ykz0+lD+GrfDtmiQy9XzDQgaeD2ra7oSCEPhQs8WOQUbS3TwaADn:amjDsad9bqra7oSjMvIwpn

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1716 788 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1716	788	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1452 wrote to memory of 788	1452	rundll32.exe	rundll32.exe
PID 1452 wrote to memory of 788	1452	rundll32.exe	rundll32.exe
PID 1452 wrote to memory of 788	1452	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\05d1b791865c9551ed8da6a170eb6f945a4d1e79cb70341f589cc47bacf78cc3.dll, DllUnregisterServer
1⤵
- Suspicious use of WriteProcessMemory
PID:1452

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\05d1b791865c9551ed8da6a170eb6f945a4d1e79cb70341f589cc47bacf78cc3.dll, DllUnregisterServer
2⤵
PID:788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 556
3⤵
- Program crash
PID:1716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 788 -ip 788
1⤵
PID:2112