e72f8eb2629b3a92e0108aaf90b0ccf25a2a2117d2ea14df0b24bb314382be35

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
20-10-2023 06:06

Target

e72f8eb2629b3a92e0108aaf90b0ccf25a2a2117d2ea14df0b24bb314382be35.dll
Size

208KB
MD5

28fa796a706ea75cd6dda75221341905
SHA1

de7618358caa1a87e4ffd47705ba765d3feb8a73
SHA256

e72f8eb2629b3a92e0108aaf90b0ccf25a2a2117d2ea14df0b24bb314382be35
SHA512

d2a1fb33bf3994d524a6154d90fd84a320066ece9c4e94f70a192eb81d2ae4bc6e8edc0b6d442b2db64130663db3f265ffc89261be159dcf77a59ef492af497b
SSDEEP

3072:LI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdUovY59:LIDff9D8C6XYRw6MT2DEjV

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4192 2000 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4192	2000	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1884 wrote to memory of 2000	1884	rundll32.exe	rundll32.exe
PID 1884 wrote to memory of 2000	1884	rundll32.exe	rundll32.exe
PID 1884 wrote to memory of 2000	1884	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e72f8eb2629b3a92e0108aaf90b0ccf25a2a2117d2ea14df0b24bb314382be35.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e72f8eb2629b3a92e0108aaf90b0ccf25a2a2117d2ea14df0b24bb314382be35.dll,#1
  2⤵
  PID:2000
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 632
    3⤵
    - Program crash
    PID:4192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2000 -ip 2000
1⤵
PID:4808