aa16e07ecb03e6e55248f0b2c59efecc6a59f9d78cbb6c6e8294fc2714debbbf

Analysis

max time kernel
104s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2022, 12:17

Target
1948-57-0x0000000010000000-0x000000001000E000-memory.dll
Size 56KB
Sample220809-pf8glabgd3
SHA256 aa16e07ecb03e6e55248f0b2c59efecc6a59f9d78cbb6c6e8294fc2714debbbf
MD5 a1a94bbfeca70b2aef3054cd50b97a2b
SHA1 b07092d895ffbd23888246f13a89823a85e34304
SHA512 ddc1c16f9d58ac6fa5de968c97baaf4ac0ffa346f931420aa494090a61e4faa19c983e20d56ed6bbb4c59b835c22e0d85380576564f57bfb2a99219ddaaf37a1
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3988	1164	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 1164	2608	rundll32.exe	83
PID 2608 wrote to memory of 1164	2608	rundll32.exe	83
PID 2608 wrote to memory of 1164	2608	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1948-57-0x0000000010000000-0x000000001000E000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1948-57-0x0000000010000000-0x000000001000E000-memory.dll,#1
  2⤵
  PID:1164
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 560
    3⤵
    - Program crash
    PID:3988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1164 -ip 1164
1⤵
PID:3292