3091e6ec4cd2f4835237b163af92a5b168159bb903d5641c6c87aff7d4295d6e

Analysis

max time kernel
84s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
30/06/2023, 09:55

Target

3091e6ec4cd2f4835237b163af92a5b168159bb903d5641c6c87aff7d4295d6e.dll
Size

4.1MB
MD5

e2fb22293e7f3d39cc7d4e31aa856f51
SHA1

f722af9d4f3b691ff6c74f750e1be3fee33519d7
SHA256

3091e6ec4cd2f4835237b163af92a5b168159bb903d5641c6c87aff7d4295d6e
SHA512

c24c9d71e2f6522899809293bb5590153bd3507e9effc4264ea37136a02ff04516fdc52876dcf3b81a5bc99efe037981da82597a8ff3c4fa09bd1dcb19e526c9
SSDEEP

98304:S4pmrmc2lAu28lkcf5YjovKqGYiOE8oLj5xIH:SpmZl85gyjovK65E8oIH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4568	4292	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 4292	4440	rundll32.exe	82
PID 4440 wrote to memory of 4292	4440	rundll32.exe	82
PID 4440 wrote to memory of 4292	4440	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3091e6ec4cd2f4835237b163af92a5b168159bb903d5641c6c87aff7d4295d6e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3091e6ec4cd2f4835237b163af92a5b168159bb903d5641c6c87aff7d4295d6e.dll,#1
  2⤵
  PID:4292
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 684
    3⤵
    - Program crash
    PID:4568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4292 -ip 4292
1⤵
PID:4552