87b1209f93f82c66524e1ea510eccdcb765ccda140a1cd93a42a135a5fdda424

Analysis

max time kernel
132s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2022, 12:40

Target
1832-57-0x0000000010000000-0x000000001000E000-memory.dll
Size 56KB
Sample220809-pwfrhsaddl
SHA256 87b1209f93f82c66524e1ea510eccdcb765ccda140a1cd93a42a135a5fdda424
MD5 0041b6e645c5dcd86ec9346cd2cc89b6
SHA1 408b1f2a4e6f54119e081ab314cd15b6211216c0
SHA512 968ec20bacf0997a7f65e79a605d7ae5f0c5e57933944e6cbf6c3d67014c2e2c325f4ed092e20dfff524cabaf029df2638dc6a2969a3a72ebc8a4a0d02eb5881
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2456	2672	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 428 wrote to memory of 2672	428	rundll32.exe	82
PID 428 wrote to memory of 2672	428	rundll32.exe	82
PID 428 wrote to memory of 2672	428	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1832-57-0x0000000010000000-0x000000001000E000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:428
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1832-57-0x0000000010000000-0x000000001000E000-memory.dll,#1
  2⤵
  PID:2672
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 560
    3⤵
    - Program crash
    PID:2456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2672 -ip 2672
1⤵
PID:1868