56622e82a4cbe7893866f2637ec2651f39b9d99cd0d07408aafad56350a4cea5

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 10:48

Target

56622e82a4cbe7893866f2637ec2651f39b9d99cd0d07408aafad56350a4cea5.dll
Size

46KB
MD5

f27af6fffff29a427b586f6223afc3cc
SHA1

170bf98a2ec231833a3dff369dbf0082d0570d77
SHA256

56622e82a4cbe7893866f2637ec2651f39b9d99cd0d07408aafad56350a4cea5
SHA512

8df4356b67499de9e33b8b48bf0c0d61cae00383ce786586a9d9df0c180f541a1440f38c5f1ebb2c1169006febcf810b84bdc6c6bc1a1e02f8f063e4ee6cee94
SSDEEP

768:/L40Gy309O4iqhZgKpJowpL++7DWGuTuEjrOzAb6XTbJGtp:/LEy3NkZgKpJowp/7SGauEjr96jbJyp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3644	896	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 896	1756	rundll32.exe	81
PID 1756 wrote to memory of 896	1756	rundll32.exe	81
PID 1756 wrote to memory of 896	1756	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\56622e82a4cbe7893866f2637ec2651f39b9d99cd0d07408aafad56350a4cea5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\56622e82a4cbe7893866f2637ec2651f39b9d99cd0d07408aafad56350a4cea5.dll,#1
  2⤵
  PID:896
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 896 -s 616
    3⤵
    - Program crash
    PID:3644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 896 -ip 896
1⤵
PID:2836