Analysis
-
max time kernel
122s -
max time network
137s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
21-10-2021 18:02
Static task
static1
Behavioral task
behavioral1
Sample
ea785ebe3cb6409d9fed610f8c21f967.exe
Resource
win7-en-20211014
General
-
Target
ea785ebe3cb6409d9fed610f8c21f967.exe
-
Size
57KB
-
MD5
ea785ebe3cb6409d9fed610f8c21f967
-
SHA1
e76264063483ead9d65cfe31ba12282b7d95edba
-
SHA256
d03c843490124f40cf12e9cf9ceb3435d564b4b58ad6eecc04046476dc27d29a
-
SHA512
1adfd2246fd3f6749cce3348a12558594ab693c1d40e6cfbf1f3f42c855a89518bc2750958d28d8d43b4df28213d6f6e8ff34638a8f2e805b9e550ce86300daf
Malware Config
Signatures
-
Turns off Windows Defender SpyNet reporting 2 TTPs
-
Nirsoft 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\fc1e04c1-1788-48e8-a726-ed8e85ef7f5f\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\fc1e04c1-1788-48e8-a726-ed8e85ef7f5f\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\fc1e04c1-1788-48e8-a726-ed8e85ef7f5f\AdvancedRun.exe Nirsoft -
Executes dropped EXE 2 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exepid process 1444 AdvancedRun.exe 1288 AdvancedRun.exe -
Processes:
ea785ebe3cb6409d9fed610f8c21f967.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths ea785ebe3cb6409d9fed610f8c21f967.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\Documents\玁獹獎玃獍獨獎獽獇獈獻獎獍獛獼\svchost.exe = "0" ea785ebe3cb6409d9fed610f8c21f967.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\ea785ebe3cb6409d9fed610f8c21f967.exe = "0" ea785ebe3cb6409d9fed610f8c21f967.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" ea785ebe3cb6409d9fed610f8c21f967.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet ea785ebe3cb6409d9fed610f8c21f967.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0" ea785ebe3cb6409d9fed610f8c21f967.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" ea785ebe3cb6409d9fed610f8c21f967.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions ea785ebe3cb6409d9fed610f8c21f967.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection ea785ebe3cb6409d9fed610f8c21f967.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0" ea785ebe3cb6409d9fed610f8c21f967.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features ea785ebe3cb6409d9fed610f8c21f967.exe -
Drops file in Windows directory 1 IoCs
Processes:
WerFault.exedescription ioc process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1660 4092 WerFault.exe ea785ebe3cb6409d9fed610f8c21f967.exe -
Suspicious behavior: EnumeratesProcesses 34 IoCs
Processes:
AdvancedRun.exepowershell.exepowershell.exepowershell.exeAdvancedRun.exepowershell.exeWerFault.exepid process 1444 AdvancedRun.exe 1444 AdvancedRun.exe 1444 AdvancedRun.exe 1444 AdvancedRun.exe 1988 powershell.exe 648 powershell.exe 828 powershell.exe 1288 AdvancedRun.exe 1288 AdvancedRun.exe 1288 AdvancedRun.exe 1288 AdvancedRun.exe 1988 powershell.exe 648 powershell.exe 828 powershell.exe 828 powershell.exe 648 powershell.exe 1988 powershell.exe 2124 powershell.exe 2124 powershell.exe 2124 powershell.exe 1660 WerFault.exe 1660 WerFault.exe 1660 WerFault.exe 1660 WerFault.exe 1660 WerFault.exe 1660 WerFault.exe 1660 WerFault.exe 1660 WerFault.exe 1660 WerFault.exe 1660 WerFault.exe 1660 WerFault.exe 1660 WerFault.exe 1660 WerFault.exe 1660 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
Processes:
ea785ebe3cb6409d9fed610f8c21f967.exepowershell.exepowershell.exepowershell.exeAdvancedRun.exeAdvancedRun.exepowershell.exeWerFault.exedescription pid process Token: SeDebugPrivilege 4092 ea785ebe3cb6409d9fed610f8c21f967.exe Token: SeDebugPrivilege 648 powershell.exe Token: SeDebugPrivilege 828 powershell.exe Token: SeDebugPrivilege 1988 powershell.exe Token: SeDebugPrivilege 1444 AdvancedRun.exe Token: SeImpersonatePrivilege 1444 AdvancedRun.exe Token: SeDebugPrivilege 1288 AdvancedRun.exe Token: SeImpersonatePrivilege 1288 AdvancedRun.exe Token: SeDebugPrivilege 2124 powershell.exe Token: SeRestorePrivilege 1660 WerFault.exe Token: SeBackupPrivilege 1660 WerFault.exe Token: SeBackupPrivilege 1660 WerFault.exe Token: SeDebugPrivilege 1660 WerFault.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
ea785ebe3cb6409d9fed610f8c21f967.exeAdvancedRun.exedescription pid process target process PID 4092 wrote to memory of 828 4092 ea785ebe3cb6409d9fed610f8c21f967.exe powershell.exe PID 4092 wrote to memory of 828 4092 ea785ebe3cb6409d9fed610f8c21f967.exe powershell.exe PID 4092 wrote to memory of 828 4092 ea785ebe3cb6409d9fed610f8c21f967.exe powershell.exe PID 4092 wrote to memory of 1988 4092 ea785ebe3cb6409d9fed610f8c21f967.exe powershell.exe PID 4092 wrote to memory of 1988 4092 ea785ebe3cb6409d9fed610f8c21f967.exe powershell.exe PID 4092 wrote to memory of 1988 4092 ea785ebe3cb6409d9fed610f8c21f967.exe powershell.exe PID 4092 wrote to memory of 648 4092 ea785ebe3cb6409d9fed610f8c21f967.exe powershell.exe PID 4092 wrote to memory of 648 4092 ea785ebe3cb6409d9fed610f8c21f967.exe powershell.exe PID 4092 wrote to memory of 648 4092 ea785ebe3cb6409d9fed610f8c21f967.exe powershell.exe PID 4092 wrote to memory of 1444 4092 ea785ebe3cb6409d9fed610f8c21f967.exe AdvancedRun.exe PID 4092 wrote to memory of 1444 4092 ea785ebe3cb6409d9fed610f8c21f967.exe AdvancedRun.exe PID 4092 wrote to memory of 1444 4092 ea785ebe3cb6409d9fed610f8c21f967.exe AdvancedRun.exe PID 1444 wrote to memory of 1288 1444 AdvancedRun.exe AdvancedRun.exe PID 1444 wrote to memory of 1288 1444 AdvancedRun.exe AdvancedRun.exe PID 1444 wrote to memory of 1288 1444 AdvancedRun.exe AdvancedRun.exe PID 4092 wrote to memory of 2124 4092 ea785ebe3cb6409d9fed610f8c21f967.exe powershell.exe PID 4092 wrote to memory of 2124 4092 ea785ebe3cb6409d9fed610f8c21f967.exe powershell.exe PID 4092 wrote to memory of 2124 4092 ea785ebe3cb6409d9fed610f8c21f967.exe powershell.exe PID 4092 wrote to memory of 2376 4092 ea785ebe3cb6409d9fed610f8c21f967.exe ea785ebe3cb6409d9fed610f8c21f967.exe PID 4092 wrote to memory of 2376 4092 ea785ebe3cb6409d9fed610f8c21f967.exe ea785ebe3cb6409d9fed610f8c21f967.exe PID 4092 wrote to memory of 2376 4092 ea785ebe3cb6409d9fed610f8c21f967.exe ea785ebe3cb6409d9fed610f8c21f967.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea785ebe3cb6409d9fed610f8c21f967.exe"C:\Users\Admin\AppData\Local\Temp\ea785ebe3cb6409d9fed610f8c21f967.exe"1⤵
- Windows security modification
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\玁獹獎玃獍獨獎獽獇獈獻獎獍獛獼\svchost.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ea785ebe3cb6409d9fed610f8c21f967.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\玁獹獎玃獍獨獎獽獇獈獻獎獍獛獼\svchost.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\fc1e04c1-1788-48e8-a726-ed8e85ef7f5f\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\fc1e04c1-1788-48e8-a726-ed8e85ef7f5f\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\fc1e04c1-1788-48e8-a726-ed8e85ef7f5f\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fc1e04c1-1788-48e8-a726-ed8e85ef7f5f\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\fc1e04c1-1788-48e8-a726-ed8e85ef7f5f\AdvancedRun.exe" /SpecialRun 4101d8 14443⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ea785ebe3cb6409d9fed610f8c21f967.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\ea785ebe3cb6409d9fed610f8c21f967.exeC:\Users\Admin\AppData\Local\Temp\ea785ebe3cb6409d9fed610f8c21f967.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 25042⤵
- Drops file in Windows directory
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logMD5
db01a2c1c7e70b2b038edf8ad5ad9826
SHA1540217c647a73bad8d8a79e3a0f3998b5abd199b
SHA256413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d
SHA512c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheMD5
7247129cd0644457905b7d6bf17fd078
SHA1dbf9139b5a1b72141f170d2eae911bbbe7e128c8
SHA256dfa6e0d79449f29310b2a0400dc7fa5a3a6b08182233147a81902d1f80a0f8e4
SHA5129b1ebd7fe485811f10ec02778d90a7f7eccafa0231027b640b94eaed8408107051da7fcc4f17a9aa0eef900fa2595f44be7fd115331fb6da9b10076f5fcf87e0
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheMD5
7247129cd0644457905b7d6bf17fd078
SHA1dbf9139b5a1b72141f170d2eae911bbbe7e128c8
SHA256dfa6e0d79449f29310b2a0400dc7fa5a3a6b08182233147a81902d1f80a0f8e4
SHA5129b1ebd7fe485811f10ec02778d90a7f7eccafa0231027b640b94eaed8408107051da7fcc4f17a9aa0eef900fa2595f44be7fd115331fb6da9b10076f5fcf87e0
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheMD5
7247129cd0644457905b7d6bf17fd078
SHA1dbf9139b5a1b72141f170d2eae911bbbe7e128c8
SHA256dfa6e0d79449f29310b2a0400dc7fa5a3a6b08182233147a81902d1f80a0f8e4
SHA5129b1ebd7fe485811f10ec02778d90a7f7eccafa0231027b640b94eaed8408107051da7fcc4f17a9aa0eef900fa2595f44be7fd115331fb6da9b10076f5fcf87e0
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
800d5b195114c7e40d4f9a300570814b
SHA12b30ab552559c84aae369d33f48b29ff53996e73
SHA256527711d05afee0b872af11706568761815a5abe232b0d7b41e61b303ac7a407e
SHA5124452c2ce856e2e125045f20de5e63a19cb7d1f5fb09cdff0795e6e4943b82294668f35e05ac5bd280c394444415b4daefcddd2fe632d3884672427ce4a910888
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
800d5b195114c7e40d4f9a300570814b
SHA12b30ab552559c84aae369d33f48b29ff53996e73
SHA256527711d05afee0b872af11706568761815a5abe232b0d7b41e61b303ac7a407e
SHA5124452c2ce856e2e125045f20de5e63a19cb7d1f5fb09cdff0795e6e4943b82294668f35e05ac5bd280c394444415b4daefcddd2fe632d3884672427ce4a910888
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
67d36b29d8758a3c50c459d6d2a99dd7
SHA14a28f9b913f07fa699e15d8136892fecbf127c4e
SHA2560fdee3bb047b7564a3ab477042307571a5671f61e78abe9f8b67d914eccec54a
SHA512a7df0638f4693fb5caeb1a93fec10dcb79f0471e5d7b9ae3fd2fb40de6351b9bd26a5a8e9d6798fd8fed59bdbdec0ea053407ce0d04078e97b05897df1dbeecc
-
C:\Users\Admin\AppData\Local\Temp\fc1e04c1-1788-48e8-a726-ed8e85ef7f5f\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\fc1e04c1-1788-48e8-a726-ed8e85ef7f5f\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\fc1e04c1-1788-48e8-a726-ed8e85ef7f5f\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
memory/648-164-0x0000000007920000-0x0000000007921000-memory.dmpFilesize
4KB
-
memory/648-123-0x0000000000000000-mapping.dmp
-
memory/648-250-0x0000000006723000-0x0000000006724000-memory.dmpFilesize
4KB
-
memory/648-128-0x0000000000B40000-0x0000000000B41000-memory.dmpFilesize
4KB
-
memory/648-131-0x0000000000B40000-0x0000000000B41000-memory.dmpFilesize
4KB
-
memory/648-167-0x0000000007C40000-0x0000000007C41000-memory.dmpFilesize
4KB
-
memory/648-153-0x00000000074E0000-0x00000000074E1000-memory.dmpFilesize
4KB
-
memory/648-140-0x0000000006722000-0x0000000006723000-memory.dmpFilesize
4KB
-
memory/648-229-0x000000007EDB0000-0x000000007EDB1000-memory.dmpFilesize
4KB
-
memory/648-139-0x0000000006720000-0x0000000006721000-memory.dmpFilesize
4KB
-
memory/648-172-0x0000000000B40000-0x0000000000B41000-memory.dmpFilesize
4KB
-
memory/828-134-0x0000000007240000-0x0000000007241000-memory.dmpFilesize
4KB
-
memory/828-225-0x000000007EC40000-0x000000007EC41000-memory.dmpFilesize
4KB
-
memory/828-141-0x0000000006C02000-0x0000000006C03000-memory.dmpFilesize
4KB
-
memory/828-137-0x0000000006C00000-0x0000000006C01000-memory.dmpFilesize
4KB
-
memory/828-161-0x0000000007220000-0x0000000007221000-memory.dmpFilesize
4KB
-
memory/828-171-0x0000000002D40000-0x0000000002D41000-memory.dmpFilesize
4KB
-
memory/828-249-0x0000000006C03000-0x0000000006C04000-memory.dmpFilesize
4KB
-
memory/828-125-0x0000000002D40000-0x0000000002D41000-memory.dmpFilesize
4KB
-
memory/828-124-0x0000000002D40000-0x0000000002D41000-memory.dmpFilesize
4KB
-
memory/828-121-0x0000000000000000-mapping.dmp
-
memory/1288-156-0x0000000000000000-mapping.dmp
-
memory/1444-144-0x0000000000000000-mapping.dmp
-
memory/1988-147-0x0000000007380000-0x0000000007381000-memory.dmpFilesize
4KB
-
memory/1988-126-0x0000000002DD0000-0x0000000002DD1000-memory.dmpFilesize
4KB
-
memory/1988-150-0x0000000007530000-0x0000000007531000-memory.dmpFilesize
4KB
-
memory/1988-170-0x0000000002DD0000-0x0000000002DD1000-memory.dmpFilesize
4KB
-
memory/1988-122-0x0000000000000000-mapping.dmp
-
memory/1988-127-0x0000000002DD0000-0x0000000002DD1000-memory.dmpFilesize
4KB
-
memory/1988-158-0x0000000007CF0000-0x0000000007CF1000-memory.dmpFilesize
4KB
-
memory/1988-251-0x0000000006FD3000-0x0000000006FD4000-memory.dmpFilesize
4KB
-
memory/1988-129-0x0000000004920000-0x0000000004921000-memory.dmpFilesize
4KB
-
memory/1988-234-0x000000007E2C0000-0x000000007E2C1000-memory.dmpFilesize
4KB
-
memory/1988-138-0x0000000006FD0000-0x0000000006FD1000-memory.dmpFilesize
4KB
-
memory/1988-142-0x0000000006FD2000-0x0000000006FD3000-memory.dmpFilesize
4KB
-
memory/2124-295-0x0000000006883000-0x0000000006884000-memory.dmpFilesize
4KB
-
memory/2124-182-0x0000000006882000-0x0000000006883000-memory.dmpFilesize
4KB
-
memory/2124-176-0x0000000000000000-mapping.dmp
-
memory/2124-177-0x0000000000780000-0x0000000000781000-memory.dmpFilesize
4KB
-
memory/2124-178-0x0000000000780000-0x0000000000781000-memory.dmpFilesize
4KB
-
memory/2124-289-0x000000007EC70000-0x000000007EC71000-memory.dmpFilesize
4KB
-
memory/2124-181-0x0000000006880000-0x0000000006881000-memory.dmpFilesize
4KB
-
memory/4092-133-0x0000000006D10000-0x0000000006D11000-memory.dmpFilesize
4KB
-
memory/4092-120-0x0000000007110000-0x0000000007111000-memory.dmpFilesize
4KB
-
memory/4092-115-0x0000000000700000-0x0000000000701000-memory.dmpFilesize
4KB
-
memory/4092-143-0x0000000006CD0000-0x0000000006CD1000-memory.dmpFilesize
4KB
-
memory/4092-119-0x0000000006AD0000-0x0000000006B36000-memory.dmpFilesize
408KB
-
memory/4092-118-0x0000000006B70000-0x0000000006B71000-memory.dmpFilesize
4KB
-
memory/4092-117-0x0000000004FD0000-0x0000000004FD1000-memory.dmpFilesize
4KB