ffa44495aa5f5c930256a3eadda02bfc01da733ab0879ada34d117978ef9ee5c

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2023 11:21

Target

easy_Benign_ffa44495aa5f5c930256a3eadda02bfc01da733ab0879ada34d117978ef9ee5c.dll
Size

21KB
MD5

46b610f325f3eef12d3d6fdd9ed65897
SHA1

3f44e690ebfd5c269fc065ef85d527d79ee543d2
SHA256

ffa44495aa5f5c930256a3eadda02bfc01da733ab0879ada34d117978ef9ee5c
SHA512

7fcf50e4712bf2377cfc9088c0bee03a7a886661e24408fb9229000d359385b6d6afb47815668cfeb3b1cca0813cc26520f219a6fdcd026418d5a8b231d0221c
SSDEEP

384:j6PvVX7W1hWPSYHNfPfLeEdtpBjdYg1YGf3M8pUclhdS:uPvVXe3YBbeElrYg1YG08pU5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4968	4048	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 4048	3300	rundll32.exe	85
PID 3300 wrote to memory of 4048	3300	rundll32.exe	85
PID 3300 wrote to memory of 4048	3300	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\easy_Benign_ffa44495aa5f5c930256a3eadda02bfc01da733ab0879ada34d117978ef9ee5c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\easy_Benign_ffa44495aa5f5c930256a3eadda02bfc01da733ab0879ada34d117978ef9ee5c.dll,#1
  2⤵
  PID:4048
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 600
    3⤵
    - Program crash
    PID:4968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 4048 -ip 4048
1⤵
PID:3720