48eca625d325c3c8559e057143866b3b54191a1ca4eb3f6f19ce0a5e9c3834d0

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
31/08/2022, 17:17

Target
2000-58-0x00000000007E0000-0x000000000085E000-memory.dll
Size 504KB
Sample220831-vt8bmsbag6
SHA256 48eca625d325c3c8559e057143866b3b54191a1ca4eb3f6f19ce0a5e9c3834d0
MD5 84705b2526162d19bf6157f0231b1c9b
SHA1 30c62dd1b3710a4ca5dcaeab1868c6e2b919c96b
SHA512 067b28794d234f68efda27ab4f16f3970eca3091a9f9d239b5c3571e0a8807fb61b4ab4b935343abe9d9b0388620735a5315779aa718b8bc463cb0c79b22756f
SSDEEP 768:c2QgrUi08sgURM7jtVvgsyTdcNtW2RTYBfx6w39rDE3Lkjx2K/ZK38u3O:528sbM7jt6sideD8B56w39HE384h387
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4704	2036	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3492 wrote to memory of 2036	3492	rundll32.exe	82
PID 3492 wrote to memory of 2036	3492	rundll32.exe	82
PID 3492 wrote to memory of 2036	3492	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2000-58-0x00000000007E0000-0x000000000085E000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2000-58-0x00000000007E0000-0x000000000085E000-memory.dll,#1
  2⤵
  PID:2036
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 560
    3⤵
    - Program crash
    PID:4704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2036 -ip 2036
1⤵
PID:4008