020852ac13c272d2033bb12acc67838d417a620bdebc8153c8aa32d82b24efc3

Analysis

max time kernel
117s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
29-09-2023 02:26

Target

020852ac13c272d2033bb12acc67838d417a620bdebc8153c8aa32d82b24efc3.dll
Size

208KB
MD5

6f8e32c572cdef46e506a1577f3cc752
SHA1

bee22a9384e1623310e027be6eab2d9781ac5966
SHA256

020852ac13c272d2033bb12acc67838d417a620bdebc8153c8aa32d82b24efc3
SHA512

1f19280e91433130d5845c312a76944aa99ee28da4fe7580f6e3d5b8b62c5377b019242dff60aaa6375b701c9579ee4e1dde53b6e468b3ca3ad7d631297b2f9d
SSDEEP

3072:aI6CqRCxffkClDn7LQlRw6x+Y3CxT2DtK5jdUfY5w:aIDff9NXYRw6MT2DEj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4716 3712 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4716	3712	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1636 wrote to memory of 3712	1636	rundll32.exe	rundll32.exe
PID 1636 wrote to memory of 3712	1636	rundll32.exe	rundll32.exe
PID 1636 wrote to memory of 3712	1636	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\020852ac13c272d2033bb12acc67838d417a620bdebc8153c8aa32d82b24efc3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1636

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\020852ac13c272d2033bb12acc67838d417a620bdebc8153c8aa32d82b24efc3.dll,#1
2⤵
PID:3712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3712 -s 636
3⤵
- Program crash
PID:4716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3712 -ip 3712
1⤵
PID:3428