cae9481dbf50fa4d7766c456aff23016dfd24d4233668b906cd7e1b8562f5677

Analysis

max time kernel
127s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
13/08/2023, 05:57

Target
cae9481dbf50fa4d7766c456aff23016dfd24d4233668b906cd7e1b8562f5677.dll
Size 205KB
Sample230813-gn455shd65
SHA256 cae9481dbf50fa4d7766c456aff23016dfd24d4233668b906cd7e1b8562f5677
MD5 f2fc84502b6b57bdf777e3c984a26588
SHA1 b0d4d4a96ada7049dbd8dc03487ea97a5f84b20d
SHA512 5244c2bc02795543efa9493f8a823fc74ac56057c56d2cbe4009118e74e32748cd481bd1a238870c4e9db5b6d515c2361bbf12e73ae027e60a49631507a0a89c
SSDEEP 3072:v/QPFX1eqEfuBNSYuiM8CDj8hFsoMX0ghsJRgCD3iFw9jdUs5H:v/MEfuN0t8C/oFsoeRM3o0jd
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2516	4948	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4044 wrote to memory of 4948	4044	rundll32.exe	82
PID 4044 wrote to memory of 4948	4044	rundll32.exe	82
PID 4044 wrote to memory of 4948	4044	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cae9481dbf50fa4d7766c456aff23016dfd24d4233668b906cd7e1b8562f5677.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cae9481dbf50fa4d7766c456aff23016dfd24d4233668b906cd7e1b8562f5677.dll,#1
  2⤵
  PID:4948
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 632
    3⤵
    - Program crash
    PID:2516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4948 -ip 4948
1⤵
PID:3888