7af9b07b89421db3b1a28e3c6d7fa64631a2bd2b38cbe91a6521407e6df1898e

Analysis

max time kernel
137s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 00:41

Target

221136acb87302edba377abc6bd4be9b.dll
Size

125KB
MD5

221136acb87302edba377abc6bd4be9b
SHA1

22cd1867d8697b218113f2bd9859b85523dd6d04
SHA256

7af9b07b89421db3b1a28e3c6d7fa64631a2bd2b38cbe91a6521407e6df1898e
SHA512

b602e24e291c2a4c39237fcb17f978da23be4c1a4408425c1ede4c676e5087d413ddb77619560981cd059102e25f968df7218e8818e408eabb3b27809c7da74b
SSDEEP

192:6J1FnAsxOIfnxn+nHnYxOIfnxn+nHnIxOIfnxn+nHn4xOIfnxn+nHnbxOIfn:6TFTOIx+HsOIx+HcOIx+HMOIx+H1OI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1512	3076	WerFault.exe	16

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 3076	844	rundll32.exe	16
PID 844 wrote to memory of 3076	844	rundll32.exe	16
PID 844 wrote to memory of 3076	844	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\221136acb87302edba377abc6bd4be9b.dll,#1
1⤵
PID:3076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3076 -s 560
  2⤵
  - Program crash
  PID:1512

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\221136acb87302edba377abc6bd4be9b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3076 -ip 3076
1⤵
PID:1136