825a0908d609a34f6882ace2132449babd4abf7bac04c4d1d4a7fd78b6d8a132

Analysis

max time kernel
128s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2023, 11:29

Target

825a0908d609a34f6882ace2132449babd4abf7bac04c4d1d4a7fd78b6d8a132.dll
Size

2.1MB
MD5

50322fbbb5e5326e4c74f6bcd9379393
SHA1

f92adbb15ffc81786df945f30a03228f9ef295fb
SHA256

825a0908d609a34f6882ace2132449babd4abf7bac04c4d1d4a7fd78b6d8a132
SHA512

0df01cd01bca4082936d19db9bc738ebfb2e303aa26e2d741f467b8a057b6097878d27bd8adc554be121e91b2f2c35a751a8529d83796b1944571bb107da18c5
SSDEEP

49152:V6pjvq+CSvnMCf01Vf6ym096oUzDEqF+4uTQIaV1:Qp7q+CSA8LzDEz4f1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3936	5016	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 5016	2656	rundll32.exe	80
PID 2656 wrote to memory of 5016	2656	rundll32.exe	80
PID 2656 wrote to memory of 5016	2656	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\825a0908d609a34f6882ace2132449babd4abf7bac04c4d1d4a7fd78b6d8a132.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\825a0908d609a34f6882ace2132449babd4abf7bac04c4d1d4a7fd78b6d8a132.dll,#1
  2⤵
  PID:5016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 564
    3⤵
    - Program crash
    PID:3936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 5016 -ip 5016
1⤵
PID:2864