d81f2faf9ff29f7217d3fb93cdaecf3d224ed2363c5ff9c70ee5359bc2064992

Analysis

max time kernel
141s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2023, 22:17

Target

d81f2faf9ff29f7217d3fb93cdaecf3d224ed2363c5ff9c70ee5359bc2064992.dll
Size

2.1MB
MD5

6bef9e87abf768809d4b31e9d8fe5744
SHA1

ad2235b04504e176ed292737cd533e4117981ce2
SHA256

d81f2faf9ff29f7217d3fb93cdaecf3d224ed2363c5ff9c70ee5359bc2064992
SHA512

afbb659dd6e61e0c401c668ba371c4cf851875e8fbc3ec412c0cc9fad2da71e29de2d7745b9b1b441e3bf564bfb56bd2ee06949a735e9a2bae3cb273d655dee8
SSDEEP

49152:y8feI79oK2xUrHvj1PYbhJ/P0BDpinATs75a78t+:y8D7WK2UrtfBDpgh08t+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3564	2652	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 2652	892	rundll32.exe	82
PID 892 wrote to memory of 2652	892	rundll32.exe	82
PID 892 wrote to memory of 2652	892	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d81f2faf9ff29f7217d3fb93cdaecf3d224ed2363c5ff9c70ee5359bc2064992.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:892
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d81f2faf9ff29f7217d3fb93cdaecf3d224ed2363c5ff9c70ee5359bc2064992.dll,#1
  2⤵
  PID:2652
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 564
    3⤵
    - Program crash
    PID:3564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2652 -ip 2652
1⤵
PID:4564