696e5163467550462860b02730da65aa8a11632af818b2e1b98f29683144bac1

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 13:28

Target

696e5163467550462860b02730da65aa8a11632af818b2e1b98f29683144bac1.dll
Size

2.1MB
MD5

6833fe712e985dafcb65d58ad519434c
SHA1

fd4bab1ab83b7ee28263d6d72fb269865e78dca2
SHA256

696e5163467550462860b02730da65aa8a11632af818b2e1b98f29683144bac1
SHA512

15f977101c45b964892342b3667fac9a466d80d350c062b0d867799eaf48ff42f19963f2edb683028aeeaf3a08fd41849307fd6b4f3ee51bd15869474030e71a
SSDEEP

49152:yrfeI79oK2xUrHv31PSbhJ/P0BDpinATs75a78t0:yrD7WK2U/tRBDpgh08t0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4748	4580	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 4580	852	rundll32.exe	86
PID 852 wrote to memory of 4580	852	rundll32.exe	86
PID 852 wrote to memory of 4580	852	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\696e5163467550462860b02730da65aa8a11632af818b2e1b98f29683144bac1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\696e5163467550462860b02730da65aa8a11632af818b2e1b98f29683144bac1.dll,#1
  2⤵
  PID:4580
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 564
    3⤵
    - Program crash
    PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4580 -ip 4580
1⤵
PID:3748