49f7a6ebe57a97153cafc4b114f4d822f2bb58ef7703f60a48fc2be784d81d03

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2023, 14:37

Target

49f7a6ebe57a97153cafc4b114f4d822f2bb58ef7703f60a48fc2be784d81d03.dll
Size

2.2MB
MD5

990201ee8e5ed8cbba7b6b96282ea82d
SHA1

179ae168dea30992998f325ea6fda5871058e27f
SHA256

49f7a6ebe57a97153cafc4b114f4d822f2bb58ef7703f60a48fc2be784d81d03
SHA512

09f334a3253e6ee26a6c972e936c4fdb0be6fc4ca590137bbd7340cf3efb89c7a7539f3f136033daf513c0a8b75d92f706ee13981dd28ee210d75fe06d81fba0
SSDEEP

49152:TId0OM5Fym/8RgJfYM97tQjFozL19wNa/Wgi0:sCOM56yJOjFKp9JWg1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2628	3376	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 3376	4524	rundll32.exe	88
PID 4524 wrote to memory of 3376	4524	rundll32.exe	88
PID 4524 wrote to memory of 3376	4524	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\49f7a6ebe57a97153cafc4b114f4d822f2bb58ef7703f60a48fc2be784d81d03.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\49f7a6ebe57a97153cafc4b114f4d822f2bb58ef7703f60a48fc2be784d81d03.dll,#1
  2⤵
  PID:3376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 564
    3⤵
    - Program crash
    PID:2628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3376 -ip 3376
1⤵
PID:2972