806dd73711885c18ceb931d3947aac56426ec8130278cfc4ced16b229cb2d4f7

Analysis

max time kernel
139s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
03-11-2023 02:49

Target

806dd73711885c18ceb931d3947aac56426ec8130278cfc4ced16b229cb2d4f7.dll
Size

2.1MB
MD5

a981b2b888a76c17c6def39652b002df
SHA1

00590a9f440492e24e3b6067557144e59126a88a
SHA256

806dd73711885c18ceb931d3947aac56426ec8130278cfc4ced16b229cb2d4f7
SHA512

4fef973ebfddbe7b390205d48b5791d81d460476fdcdbf793819940ca638c3a9b06421129edd0f1e53cad8cfbd773199568405f0b831857a6d747ab21f5fa05f
SSDEEP

49152:vcz84B8m/mJoQsXJm9mEfZOkNPSTqctjRTDpJMMG:k7qm/eIcDPSTqsL5G

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3240	2988	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 2988	5100	rundll32.exe	86
PID 5100 wrote to memory of 2988	5100	rundll32.exe	86
PID 5100 wrote to memory of 2988	5100	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\806dd73711885c18ceb931d3947aac56426ec8130278cfc4ced16b229cb2d4f7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\806dd73711885c18ceb931d3947aac56426ec8130278cfc4ced16b229cb2d4f7.dll,#1
  2⤵
  PID:2988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 564
    3⤵
    - Program crash
    PID:3240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2988 -ip 2988
1⤵
PID:2284