fe62d5e70cbe80e7ae8d2ee6304873bed95d783f3daa102be71da8d85f4d82a3

Analysis

max time kernel
101s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2024 18:33

Target

fe62d5e70cbe80e7ae8d2ee6304873bed95d783f3daa102be71da8d85f4d82a3.dll
Size

2.2MB
MD5

bcc833b5c9855b8d3e62b378f0ff8035
SHA1

2fc6c85eb0a4307ee078ef4da0c75f7116976d4c
SHA256

fe62d5e70cbe80e7ae8d2ee6304873bed95d783f3daa102be71da8d85f4d82a3
SHA512

9adf466b540c90ed580934df9fa08b57b57b2f5c3188cd295f851e5e9bfe4bbbb4800057c7fed4ffc60ff9c4edf88b0e2f86347fe2e8df735c68df2b6cb6a07a
SSDEEP

49152:TJd0OM5Fym/8zgJ3YM97tQjFozL19wNa/WgV:VCOM568J2jFKp9JWgV

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

888 232 WerFault.exe rundll32.exe

pid	pid_target	process	target process
888	232	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1608 wrote to memory of 232	1608	rundll32.exe	rundll32.exe
PID 1608 wrote to memory of 232	1608	rundll32.exe	rundll32.exe
PID 1608 wrote to memory of 232	1608	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe62d5e70cbe80e7ae8d2ee6304873bed95d783f3daa102be71da8d85f4d82a3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1608

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe62d5e70cbe80e7ae8d2ee6304873bed95d783f3daa102be71da8d85f4d82a3.dll,#1
2⤵
PID:232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 232 -s 564
3⤵
- Program crash
PID:888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 232 -ip 232
1⤵
PID:316