6ba55936e3df9fbb391c19a86d53275da3d82154af56bffe1f74ac84d5c3ea94

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2023, 17:00

Target

6ba55936e3df9fbb391c19a86d53275da3d82154af56bffe1f74ac84d5c3ea94.dll
Size

208KB
MD5

f948792507949aac87bcb47d385f4d21
SHA1

7fee5beac3ce34710511f761e98cf2643366f7ce
SHA256

6ba55936e3df9fbb391c19a86d53275da3d82154af56bffe1f74ac84d5c3ea94
SHA512

5e96a0b9cfd8fd16f213b1418186fd73d5cef07c1c23f88942f4ad395f68d3fbf4dcc212488520c6127d2eee6142a502e444f6dfc8ea69feb8a0a2857c999799
SSDEEP

3072:lKe333yAGUhS/ZDlZqASYusPQpYDCHplqNtDp7W4jnQtyoZX9gBC9uC4oz:X333jGUh8hlZnXPzDioD7QXkMEC4oz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4792	1828	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 1828	1328	rundll32.exe	82
PID 1328 wrote to memory of 1828	1328	rundll32.exe	82
PID 1328 wrote to memory of 1828	1328	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ba55936e3df9fbb391c19a86d53275da3d82154af56bffe1f74ac84d5c3ea94.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ba55936e3df9fbb391c19a86d53275da3d82154af56bffe1f74ac84d5c3ea94.dll,#1
  2⤵
  PID:1828
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1828 -s 600
    3⤵
    - Program crash
    PID:4792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1828 -ip 1828
1⤵
PID:4844