ca91e4e28e4f7cd3ddb243893216e9bc36c7637abf0ddb153f4a7fc38840682d

Analysis

max time kernel
14s
max time network
17s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18/09/2022, 22:18

Target

ca91e4e28e4f7cd3ddb243893216e9bc36c7637abf0ddb153f4a7fc38840682d.dll
Size

81KB
MD5

58e6eb3df22d6c3b781568b7744c08e9
SHA1

9c7634cb51a496bb07f6260cc3d7148f1d791825
SHA256

ca91e4e28e4f7cd3ddb243893216e9bc36c7637abf0ddb153f4a7fc38840682d
SHA512

f9e96d03d30f81c7e87dc6216f05cc949208032fd6a76e1d23861817cf046635847d6ac440e3cea69808d04528d980b2c58b4704195c5f49ef6428e5b2652fbb
SSDEEP

1536:XeGhUZS1tLIBbHgqLdXplxWmiFd9Ia8kPkKG6zss:uYUiIVAG1gIa8OG6z3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3508	2196	WerFault.exe	76

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2196	2732	rundll32.exe	76
PID 2732 wrote to memory of 2196	2732	rundll32.exe	76
PID 2732 wrote to memory of 2196	2732	rundll32.exe	76

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca91e4e28e4f7cd3ddb243893216e9bc36c7637abf0ddb153f4a7fc38840682d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca91e4e28e4f7cd3ddb243893216e9bc36c7637abf0ddb153f4a7fc38840682d.dll,#1
  2⤵
  PID:2196
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 540
    3⤵
    - Program crash
    PID:3508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2196 -ip 2196
1⤵
PID:780

memory/2196-133-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download