f7ef943775334a5a15a925f35584cf18d55ccca4fa2c90df1e58a613d84c973b

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
22-09-2023 17:57

Target

f7ef943775334a5a15a925f35584cf18d55ccca4fa2c90df1e58a613d84c973b.dll
Size

208KB
MD5

6495489f64dce65a99c1cc567a539e8b
SHA1

43cda2925453c964ed4d8a71e574b81fd6af4b26
SHA256

f7ef943775334a5a15a925f35584cf18d55ccca4fa2c90df1e58a613d84c973b
SHA512

19e1eb7cb631fa64fcd4cc54692944b9311e2a178434d8cd5ce98027374ceed9c4154c5ab3683a38446564b81e66322f6ee8c3b01dbd6ec473dff2a9e44b1a22
SSDEEP

3072:LI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdUbY50:LIDff9D8C6XYRw6MT2DEj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4400 3940 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4400	3940	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 488 wrote to memory of 3940	488	rundll32.exe	rundll32.exe
PID 488 wrote to memory of 3940	488	rundll32.exe	rundll32.exe
PID 488 wrote to memory of 3940	488	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7ef943775334a5a15a925f35584cf18d55ccca4fa2c90df1e58a613d84c973b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:488

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7ef943775334a5a15a925f35584cf18d55ccca4fa2c90df1e58a613d84c973b.dll,#1
2⤵
PID:3940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 640
3⤵
- Program crash
PID:4400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3940 -ip 3940
1⤵
PID:4388